Advisories · Technology

YunaiV yudao-cloud.

Every CVE that names YunaiV yudao-cloud among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-116016 CVE record

CVSS 7.1 High

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
- YunaiV yudao-cloud
- CWE-807
Not analysed yet 24 Oct 2026
CVE-2026-116015 CVE record

CVSS 5.3 Medium

yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
- YunaiV yudao-cloud
- Broken access control
Not analysed yet 24 Oct 2026
CVE-2026-58448 CVE record

CVSS 7.1 High

yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API
- YunaiV yudao-cloud
- Broken access control
Not analysed yet 30 Jun 2026
CVE-2026-9464 CVE record

CVSS 5.1 Medium

YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery
- YunaiV yudao-cloud
- Server-side request forgery (SSRF)
Not analysed yet 25 May 2026
CVE-2026-7710 CVE record

CVSS 6.9 Medium

YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
- YunaiV yudao-cloud
- Authentication bypass
Not analysed yet 3 May 2026
CVE-2026-7679 CVE record

CVSS 6.9 Medium

YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication
- YunaiV yudao-cloud
- Authentication bypass
Not analysed yet 3 May 2026
CVE-2026-7678 CVE record

CVSS 5.3 Medium

YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
- YunaiV yudao-cloud
- Other injection
- SQL injection
Not analysed yet 3 May 2026
CVE-2026-5148 CVE record

CVSS 5.1 Medium

YunaiV yudao-cloud page sql injection
- YunaiV yudao-cloud
- Other injection
- SQL injection
Not analysed yet 30 Mar 2026
CVE-2026-5147 CVE record

CVSS 6.9 Medium

YunaiV yudao-cloud get-by-website sql injection
- YunaiV yudao-cloud
- Other injection
- SQL injection
Not analysed yet 30 Mar 2026
CVE-2025-15098 CVE record

CVSS 5.3 Medium

YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery
- YunaiV yudao-cloud
- Server-side request forgery (SSRF)
Not analysed yet 26 Dec 2025
CVE-2025-10987 CVE record

CVSS 5.3 Medium

YunaiV yudao-cloud HTTP Request transfer improper authorization
- YunaiV yudao-cloud
- Privilege escalation
- Broken access control
Not analysed yet 26 Sept 2025
CVE-2025-10277 CVE record

CVSS 5.3 Medium

YunaiV yudao-cloud submit improper authorization
- YunaiV yudao-cloud
- Privilege escalation
- Broken access control
Not analysed yet 12 Sept 2025
CVE-2025-10275 CVE record

CVSS 5.3 Medium

YunaiV yudao-cloud transfer improper authorization
- YunaiV yudao-cloud
- Privilege escalation
- Broken access control
Not analysed yet 12 Sept 2025