https://vulnerability.circl.lu/sightings/feed 2026-10-11T23:49:32.097145+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c53a6eb0-c264-4a6d-8e95-376c1c382826/export 2026-10-11T23:49:32.122721+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c53a6eb0-c264-4a6d-8e95-376c1c382826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117421943609381322", "content": "CVE-2026-108707 - Critical Auth Bypass in Wukong_HRM allows full API takeover & sensitive HR data theft. CVSS 9.8. Restrict API access immediately. #CVE #infosec #cybersecurity\nhttps://www.valtersit.com/cve/CVE-2026-108707/", "creation_timestamp": "2026-10-11T11:04:44.554585Z"} 2026-10-11T11:04:44.554585+00:00 https://vulnerability.circl.lu/sighting/69fcc7e3-db95-43d4-af9f-8521c05c0674/export 2026-10-11T23:49:32.124477+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "69fcc7e3-db95-43d4-af9f-8521c05c0674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxl4vmeci42l", "content": "\ud83d\udea8 CVE-2026-108707 \u2014 CVSS 9.3 CRITICAL\n\nWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allow...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108707\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-11T04:07:10.538382Z"} 2026-10-11T04:07:10.538382+00:00 https://vulnerability.circl.lu/sighting/48726469-0dd3-4997-b4bf-6530c25aa8a8/export 2026-10-11T23:49:32.124663+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "48726469-0dd3-4997-b4bf-6530c25aa8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxkz6f7eu62a", "content": "CRITICAL auth bypass in WuKong_HRM (\u2264 commit 186115e): attackers can access all APIs as admin, risking HR data. Restrict endpoints and monitor logs until a fix is confirmed. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #Off...", "creation_timestamp": "2026-10-11T03:00:30.624623Z"} 2026-10-11T03:00:30.624623+00:00 https://vulnerability.circl.lu/sighting/8d2fa812-7323-4179-b647-039ea6573d76/export 2026-10-11T23:49:32.124775+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8d2fa812-7323-4179-b647-039ea6573d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117420040385406970", "content": "CRITICAL: CVE-2026-108707 in WuKong_HRM (\u2264 commit 186115e) enables auth bypass \u2014 attackers can access all HRM APIs, gaining admin rights and exposing sensitive HR data. Restrict endpoints & monitor for unauthorized access. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #OffSeq #CVE2026108707 #infosec #vulnerability", "creation_timestamp": "2026-10-11T03:00:28.699005Z"} 2026-10-11T03:00:28.699005+00:00 https://vulnerability.circl.lu/sighting/ffc30f02-ff42-47e0-8614-1ef2acc24219/export 2026-10-11T23:49:32.124927+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ffc30f02-ff42-47e0-8614-1ef2acc24219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxkxhy5v3h27", "content": "CVE-2026-108707\nThe Wukong HRM system can be accessed without a valid login token, allowing anyone on the network to call its HR APIs. This lets an attacker read payslips, salary history, personal employee information,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-11T02:30:04.770794Z"} 2026-10-11T02:30:04.770794+00:00 https://vulnerability.circl.lu/sighting/323f86e7-c719-4e3c-973e-eb40467425a9/export 2026-10-11T23:49:32.125048+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "323f86e7-c719-4e3c-973e-eb40467425a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419794679250382", "content": "CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108707https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_slip_detail_read.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_employee_export_pii.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_attachment_download_idor.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java#L35-L55https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect#WuKongOpenSource #Wukong_HRM#CVE_2026_108707#bot", "creation_timestamp": "2026-10-11T01:57:59.258055Z"} 2026-10-11T01:57:59.258055+00:00