CVE-2026-7679

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This impacts the function getAccessToken of the file yudao-module-system-biz/src/main/java/io/github/ruoyi/common/oauth2/service/impl/OAuth2TokenServiceImpl.java. Performing a manipulation results in improper authentication. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-767907.1The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter be CVE-2026-767938.1The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified befor CVE-2026-767944.6MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with CVE-2026-767957.3A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API En CVE-2026-767964.0The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate CVE-2026-767976.3The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading char CVE-2026-767986.3The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report with CVE-2026-767995.3A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/dat CVE-2026-76804.3A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/dat CVE-2026-768006.3A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post CVE-2026-768018.8The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code CVE-2026-768024.7Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply