Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

YunaiV — Vulnerabilities & Security Advisories 26

Browse all 26 CVE security advisories affecting YunaiV. AI-powered Chinese analysis, POCs, and references for each vulnerability.

YunaiV is an open-source virtualization platform primarily used for creating and managing virtual machines and containers. Historically, it has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, accounting for its 12 recorded CVEs. The platform's security posture has been compromised through insufficient input validation and improper access controls, leading to several high-severity exploits. Notable incidents include cases where unauthenticated attackers could execute arbitrary code or gain elevated system privileges, highlighting ongoing challenges in secure configuration and regular patch management.

Top products by YunaiV: yudao-cloud ruoyi-vue-pro
CVE ID Title CVSS Severity Published
CVE-2026-116007 YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication — ruoyi-vue-pro CWE-307 3.7 Low 2026-10-25
CVE-2026-116006 YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication — ruoyi-vue-pro CWE-287 7.3 High 2026-10-25
CVE-2026-116016 yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header — yudao-cloud CWE-807 7.1 High 2026-10-24
CVE-2026-116015 yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint — yudao-cloud CWE-639 4.3 Medium 2026-10-24
CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl — ruoyi-vue-pro CWE-918 5.4 Medium 2026-10-14
CVE-2026-97325 YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect — ruoyi-vue-pro CWE-601 4.3 Medium 2026-09-24
CVE-2026-97324 YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization — ruoyi-vue-pro CWE-285 7.3 High 2026-09-24
CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal — ruoyi-vue-pro CWE-22 6.3 Medium 2026-09-24
CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting — ruoyi-vue-pro CWE-79 4.3 Medium 2026-09-24
CVE-2026-97321 YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection — ruoyi-vue-pro CWE-89 6.3 Medium 2026-09-24
CVE-2026-97320 YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery — ruoyi-vue-pro CWE-918 6.3 Medium 2026-09-24
CVE-2026-58448 yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API — yudao-cloud CWE-862 6.5 Medium 2026-06-30
CVE-2026-13528 YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal — ruoyi-vue-pro CWE-22 7.3 High 2026-06-29
CVE-2026-9464 YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery — yudao-cloud CWE-918 4.7 Medium 2026-05-25
CVE-2026-7710 YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication — yudao-cloud CWE-287 7.3 High 2026-05-03
CVE-2026-7679 YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication — yudao-cloud CWE-287 7.3 High 2026-05-03
CVE-2026-7678 YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection — yudao-cloud CWE-89 6.3 Medium 2026-05-03
CVE-2026-5148 YunaiV yudao-cloud page sql injection — yudao-cloud CWE-89 4.7 Medium 2026-03-30
CVE-2026-5147 YunaiV yudao-cloud get-by-website sql injection — yudao-cloud CWE-89 7.3 High 2026-03-30
CVE-2025-15098 YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery — yudao-cloud CWE-918 6.3 Medium 2025-12-26
CVE-2025-10988 YunaiV ruoyi-vue-pro transfer improper authorization — ruoyi-vue-pro CWE-285 6.3 Medium 2025-09-26
CVE-2025-10987 YunaiV yudao-cloud HTTP Request transfer improper authorization — yudao-cloud CWE-285 6.3 Medium 2025-09-26
CVE-2025-10278 YunaiV ruoyi-vue-pro transfer improper authorization — ruoyi-vue-pro CWE-285 6.3 Medium 2025-09-12
CVE-2025-10277 YunaiV yudao-cloud submit improper authorization — yudao-cloud CWE-285 6.3 Medium 2025-09-12
CVE-2025-10276 YunaiV ruoyi-vue-pro transfer improper authorization — ruoyi-vue-pro CWE-285 6.3 Medium 2025-09-12
CVE-2025-10275 YunaiV yudao-cloud transfer improper authorization — yudao-cloud CWE-285 6.3 Medium 2025-09-12

This page lists every published CVE security advisory associated with YunaiV. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.