PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-37216 RuoYi CVE debrief

CVE-2026-37216 is a Cross Site Scripting (XSS) vulnerability in Ruoyi 4.8.2. The vulnerability exists at the interface /system/notice/add. The CVE was published and modified on 2026-06-15T20:16:26.250Z.

Vendor
RuoYi
Product
RuoYi 4.8.2
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Users of Ruoyi 4.8.2 should be aware of this Cross Site Scripting (XSS) vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability is a Cross Site Scripting (XSS) issue in Ruoyi 4.8.2 at the interface /system/notice/add.

Defensive priority

medium

Recommended defensive actions

  • Apply the necessary patches or updates to Ruoyi 4.8.2 to fix the Cross Site Scripting (XSS) vulnerability.
  • Restrict access to the /system/notice/add interface to only authorized users.
  • Implement additional security measures such as input validation and output encoding to prevent XSS attacks.

Evidence notes

The CVE record for CVE-2026-37216 can be found at [cve-org]. The NVD detail for CVE-2026-37216 can be found at [nvd]. A source reference for this vulnerability can be found at [ref-4].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-37216 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-37216

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-37216 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-37216

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.