https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 23:49:33 +0000 https://vulnerability.circl.lu/sighting/c53a6eb0-c264-4a6d-8e95-376c1c382826/export {"uuid": "c53a6eb0-c264-4a6d-8e95-376c1c382826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117421943609381322", "content": "CVE-2026-108707 - Critical Auth Bypass in Wukong_HRM allows full API takeover & sensitive HR data theft. CVSS 9.8. Restrict API access immediately. #CVE #infosec #cybersecurity\nhttps://www.valtersit.com/cve/CVE-2026-108707/", "creation_timestamp": "2026-10-11T11:04:44.554585Z"} {"uuid": "c53a6eb0-c264-4a6d-8e95-376c1c382826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117421943609381322", "content": "CVE-2026-108707 - Critical Auth Bypass in Wukong_HRM allows full API takeover & sensitive HR data theft. CVSS 9.8. Restrict API access immediately. #CVE #infosec #cybersecurity\nhttps://www.valtersit.com/cve/CVE-2026-108707/", "creation_timestamp": "2026-10-11T11:04:44.554585Z"} https://vulnerability.circl.lu/sighting/c53a6eb0-c264-4a6d-8e95-376c1c382826/export Sun, 11 Oct 2026 11:04:44 +0000 https://vulnerability.circl.lu/sighting/69fcc7e3-db95-43d4-af9f-8521c05c0674/export {"uuid": "69fcc7e3-db95-43d4-af9f-8521c05c0674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxl4vmeci42l", "content": "\ud83d\udea8 CVE-2026-108707 \u2014 CVSS 9.3 CRITICAL\n\nWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allow...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108707\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-11T04:07:10.538382Z"} {"uuid": "69fcc7e3-db95-43d4-af9f-8521c05c0674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxl4vmeci42l", "content": "\ud83d\udea8 CVE-2026-108707 \u2014 CVSS 9.3 CRITICAL\n\nWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allow...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108707\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-11T04:07:10.538382Z"} https://vulnerability.circl.lu/sighting/69fcc7e3-db95-43d4-af9f-8521c05c0674/export Sun, 11 Oct 2026 04:07:10 +0000 https://vulnerability.circl.lu/sighting/48726469-0dd3-4997-b4bf-6530c25aa8a8/export {"uuid": "48726469-0dd3-4997-b4bf-6530c25aa8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxkz6f7eu62a", "content": "CRITICAL auth bypass in WuKong_HRM (\u2264 commit 186115e): attackers can access all APIs as admin, risking HR data. Restrict endpoints and monitor logs until a fix is confirmed. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #Off...", "creation_timestamp": "2026-10-11T03:00:30.624623Z"} {"uuid": "48726469-0dd3-4997-b4bf-6530c25aa8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxkz6f7eu62a", "content": "CRITICAL auth bypass in WuKong_HRM (\u2264 commit 186115e): attackers can access all APIs as admin, risking HR data. Restrict endpoints and monitor logs until a fix is confirmed. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #Off...", "creation_timestamp": "2026-10-11T03:00:30.624623Z"} https://vulnerability.circl.lu/sighting/48726469-0dd3-4997-b4bf-6530c25aa8a8/export Sun, 11 Oct 2026 03:00:30 +0000 https://vulnerability.circl.lu/sighting/8d2fa812-7323-4179-b647-039ea6573d76/export {"uuid": "8d2fa812-7323-4179-b647-039ea6573d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117420040385406970", "content": "CRITICAL: CVE-2026-108707 in WuKong_HRM (\u2264 commit 186115e) enables auth bypass \u2014 attackers can access all HRM APIs, gaining admin rights and exposing sensitive HR data. Restrict endpoints & monitor for unauthorized access. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #OffSeq #CVE2026108707 #infosec #vulnerability", "creation_timestamp": "2026-10-11T03:00:28.699005Z"} {"uuid": "8d2fa812-7323-4179-b647-039ea6573d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117420040385406970", "content": "CRITICAL: CVE-2026-108707 in WuKong_HRM (\u2264 commit 186115e) enables auth bypass \u2014 attackers can access all HRM APIs, gaining admin rights and exposing sensitive HR data. Restrict endpoints & monitor for unauthorized access. https://radar.offseq.com/threat/cve-2026-108707-improper-authentication-in-wukongopensource-wukonghrm-13cec42117273b1c #OffSeq #CVE2026108707 #infosec #vulnerability", "creation_timestamp": "2026-10-11T03:00:28.699005Z"} https://vulnerability.circl.lu/sighting/8d2fa812-7323-4179-b647-039ea6573d76/export Sun, 11 Oct 2026 03:00:28 +0000 https://vulnerability.circl.lu/sighting/ffc30f02-ff42-47e0-8614-1ef2acc24219/export {"uuid": "ffc30f02-ff42-47e0-8614-1ef2acc24219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxkxhy5v3h27", "content": "CVE-2026-108707\nThe Wukong HRM system can be accessed without a valid login token, allowing anyone on the network to call its HR APIs. This lets an attacker read payslips, salary history, personal employee information,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-11T02:30:04.770794Z"} {"uuid": "ffc30f02-ff42-47e0-8614-1ef2acc24219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxkxhy5v3h27", "content": "CVE-2026-108707\nThe Wukong HRM system can be accessed without a valid login token, allowing anyone on the network to call its HR APIs. This lets an attacker read payslips, salary history, personal employee information,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-11T02:30:04.770794Z"} https://vulnerability.circl.lu/sighting/ffc30f02-ff42-47e0-8614-1ef2acc24219/export Sun, 11 Oct 2026 02:30:04 +0000 https://vulnerability.circl.lu/sighting/323f86e7-c719-4e3c-973e-eb40467425a9/export {"uuid": "323f86e7-c719-4e3c-973e-eb40467425a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419794679250382", "content": "CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108707https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_slip_detail_read.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_employee_export_pii.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_attachment_download_idor.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java#L35-L55https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect#WuKongOpenSource #Wukong_HRM#CVE_2026_108707#bot", "creation_timestamp": "2026-10-11T01:57:59.258055Z"} {"uuid": "323f86e7-c719-4e3c-973e-eb40467425a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108707", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419794679250382", "content": "CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108707https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_slip_detail_read.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_employee_export_pii.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_attachment_download_idor.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java#L35-L55https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect#WuKongOpenSource #Wukong_HRM#CVE_2026_108707#bot", "creation_timestamp": "2026-10-11T01:57:59.258055Z"} https://vulnerability.circl.lu/sighting/323f86e7-c719-4e3c-973e-eb40467425a9/export Sun, 11 Oct 2026 01:57:59 +0000