CVE Tools
Track your stack

Dromara

21 CVEs tracked since 2026. Since Sep 2026, none of them reached CISA KEV.

Dromara CVEs per month

Sep 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Dromara CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-09120
2026-1090

Products

The products that kept showing up in Dromara's monthly top three, with their CVEs summed over those months.

  1. Lamp-cloud82 months
  2. Skyeye41 month
  3. Mayfly-go21 month
  4. Orion-visor21 month
  5. Ruoyi-cloud-plus11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Dromara.

  1. CVE-2026-111605Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController8.1
  2. CVE-2026-110609Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter6.5
  3. CVE-2026-110107RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}4.2
  4. CVE-2026-110106RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}4.2
  5. CVE-2026-109168lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId6.5
  6. CVE-2026-109166lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById6.5
  7. CVE-2026-107781Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById7.4
  8. CVE-2026-107780Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter9.8
  9. CVE-2026-107779Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE9.8
  10. CVE-2026-94536lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource4.3
  11. CVE-2026-94535lamp-cloud through 5.10.0 Unauthorized Notification Deletion7.1
  12. CVE-2026-94534lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints7.1
  13. CVE-2026-94533lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file6.5
  14. CVE-2026-94532lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById6.5
  15. CVE-2026-93961Dromara UJCMS UserController UserController.java usernameExist improper authorization5.3

The record

Peak rank
#127 in Oct 2026
Busiest month shown
Sep 2026, 12 CVEs
Months with a KEV entry
0 since Sep 2026
Monthly snapshots
2 since 2026
Dromara's full record, month by month