CVE-2026-90939

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

PT-2026-91243

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

CVE-2026-71807

In RuoYi-Cloud-Plus versions up to 2.6.2 , the ruoyi-workflow module contains a broken access control vulnerability. Multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or a related user. As a...