Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 7.1 | CVE-2026-116016 |
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a...
YunaiV, yudao-cloudYunaiV yudao-cloud, yudao-cloud
|
NVD | |||
|
CVE-2026-116016yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a...
Executive summaryThe advisory describes an authorization bypass in yudao-cloud through 2026.09 that lets authenticated users get around row-level data scope restrictions. The advisory excerpt does not state a severity rating, and it does not state what the vendor recommends. Technical summaryThe flaw is an authorization bypass (improper enforcement of row-level data scope) in yudao-cloud through 2026.09, reachable by any authenticated user. The excerpt shows that DataPermissionRpcWebFilter reads a request header and, when it equals false, runs the request chain inside DataPermissionUtils.executeIgnore, which appears to skip data permission checks; the advisory text itself does not explicitly link the header to the bypass, so this is inferred from the code shown. Affected versions are stated only as through 2026.09, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated in the excerpt. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YunaiV/yudao-cloud/blob/d322…bFilter.java#L21-L36 Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-116015 |
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members'...
YunaiV, yudao-cloudYunaiV yudao-cloud, yudao-cloud
|
NVD | |||
|
CVE-2026-116015yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members'...
Executive summaryThe yudao-cloud platform through 2026.09 has a flaw in its mall trade module that lets a logged-in member read other members' data. The advisory is truncated and does not state a severity rating. It does not state a fix or vendor recommendation. Technical summaryThe flaw is an insecure direct object reference (broken object-level authorization) in the mall trade module. An authenticated member can read other members' records. The attached code excerpt shows the AppAfterSaleLogController /trade/after-sale-log/list endpoint, which takes an afterSaleId parameter and returns logs for that ID without any visible ownership check in the excerpt. Affected versions are stated only as through 2026.09, and no fixed version is stated. No CVSS score, workaround, or detection guidance is stated. Exploitation status is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YunaiV/yudao-cloud/blob/5933…troller.java#L33-L40 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||