Vulnerabilities
Summary — last 7 days
New vulnerabilities4,636▼ 756 vs. last week
Critical / high1,741▼ 1,327 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)973▲ 874 vs. last week
More filters
413,870 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit… | |
| Deferred | Medium (5.3) | 0.29% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in… | |
| Deferred | Medium (5.3) | 0.24% | — | Jeecg BootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter… | |
| Deferred | Medium (5.3) | 0.24% | — | Jeecg BootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id,… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwrite depart_id,… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to… | |
| Deferred | High (8.6) | 0.23% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push… | |
| Deferred | High (7.1) | 0.30% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users'… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/18/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen sys_log records to erase traces of their… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/15/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to /sys/position/edit… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint, to remove all… | |
| Deferred | Medium (5.3) | 0.27% | — | JeecgbootAI | 10/10/2026 | 10/13/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all… | |
| Deferred | Medium (5.3) | 0.24% | — | JeecgbootAI | 10/10/2026 | 10/14/2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content,… |