ageerle vulnerabilities

Products

• ageerle/ruoyi-ai 5

Latest ageerle CVEs

Newest publication first

1. CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

   Published 2026-10-09

   Medium·CVSS 5.3 EPSS 0.22%

   ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the...

2. CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search

   Published 2026-10-09

   Medium·CVSS 5.3 EPSS 0.20%

   ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private w...

3. CVE-2025-6466 ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload

   Published 2025-06-22

   Medium·CVSS 5.3 EPSS 0.39%

   A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of t...

4. CVE-2025-3202 ageerle ruoyi-ai SysNoticeController.java improper authorization

   Published 2025-04-04

   Medium·CVSS 6.9 EPSS 0.54%

   A vulnerability classified as critical has been found in ageerle ruoyi-ai up to 2.0.0. Affected is an unknown function of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysNoticeController.java. The manipulation leads to improper authorizatio...

5. CVE-2025-3199 ageerle ruoyi-ai API Interface SysModelController.java improper authorization

   Published 2025-04-04

   Medium·CVSS 6.9 EPSS 0.64%

   A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java of the component API Interfac...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.