Vulnerabilities
Summary — last 7 days
New vulnerabilities4,511▼ 880 vs. last week
Critical / high1,766▼ 1,313 vs. last week
New active exploitation (KEV)6▼ 3 vs. last week
Unscored (no CVSS)760▲ 667 vs. last week
More filters
413,410 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.6) | 0.23% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to… | |
| Deferred | Medium (5.3) | 0.19% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve pending applicants'… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job… | |
| Deferred | Medium (5.3) | 0.24% | — | Jeecg BootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file names and direct storage… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP whitelists, and header… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an attacker-controlled image… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerate role assignments and… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and identify… | |
| Deferred | High (7.1) | 0.29% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to retrieve JDBC URLs,… | |
| Deferred | Medium (5.3) | 0.26% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRuleController importExcel handler. Attackers can upload a crafted Excel workbook to bypass the system:checkRule:add permission and bulk-create… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the system-wide sys_category… | |
| Deferred | Medium (5.3) | 0.24% | — | Jeecg-bootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user to delete category dictionary nodes. Low-privileged attackers can obtain node ids from the unguarded rootList and childList endpoints and delete entire sys_category… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit… | |
| Deferred | Medium (5.3) | 0.29% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in… | |
| Deferred | Medium (5.3) | 0.24% | — | Jeecg BootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter… | |
| Deferred | Medium (5.3) | 0.24% | — | Jeecg BootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants… |