What’s Vulnerable › Products

Dromara RuoYi-Vue-Plus vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Dromara RuoYi-Vue-Plus version is affected

Latest Dromara RuoYi-Vue-Plus vulnerabilities

• CVE-2026-119647 — RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId} (CVSS 4.3)
• CVE-2026-110106 — RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} (CVSS 4.2)
• CVE-2026-77795 — Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization (CVSS 6.3)
• CVE-2026-58176 — RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints (CVSS 6.5)
• CVE-2026-2819 — Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization (CVSS 6.3)
• CVE-2025-66916 — (CVSS 9.4)
• CVE-2025-6925 — Dromara RuoYi-Vue-Plus Mail MailController.java path traversal (CVSS 9.1)