Vulnerabilities
Summary — last 7 days
New vulnerabilities5,289▲ 2,540 vs. last week
Critical / high2,970▲ 1,640 vs. last week
New active exploitation (KEV)6▼ 2 vs. last week
Unscored (no CVSS)223▲ 49 vs. last week
2 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Received | Low (2.3) | 0.27% | — | Dromara Ruoyi-cloud-plusAI | 10/13/2026 | 10/14/2026 | RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks,… | |
| Deferred | Medium (4.3) | 0.42% | — | Ruoyi-cloud-plusAI | 9/9/2026 | 9/14/2026 | In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details… |