https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 23:49:30 +0000 https://vulnerability.circl.lu/sighting/eb5f9713-d538-49ea-bdfe-674fbf307711/export {"uuid": "eb5f9713-d538-49ea-bdfe-674fbf307711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108708", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxlujug6yg2z", "content": "CVE-2026-108708\nThe Wukong_HRM system gives any signed\u2011in employee full access to sensitive information such as payslips, salary details, bank account numbers, and personal records. It also allows them to modify bank details\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-11T11:10:06.507716Z"} {"uuid": "eb5f9713-d538-49ea-bdfe-674fbf307711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108708", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxlujug6yg2z", "content": "CVE-2026-108708\nThe Wukong_HRM system gives any signed\u2011in employee full access to sensitive information such as payslips, salary details, bank account numbers, and personal records. It also allows them to modify bank details\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-11T11:10:06.507716Z"} https://vulnerability.circl.lu/sighting/eb5f9713-d538-49ea-bdfe-674fbf307711/export Sun, 11 Oct 2026 11:10:06 +0000 https://vulnerability.circl.lu/sighting/b76f92a1-9f13-4b34-b6f9-877a52cc659a/export {"uuid": "b76f92a1-9f13-4b34-b6f9-877a52cc659a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108708", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419797317523218", "content": "CVE-2026-108708 Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108708https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_archives_history.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_payroll_card_social_security.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/utils/EmployeeUtil.java#L33-L132https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-missing-authorization-via-employeeaspect-and-employeeutil#WuKongOpenSource #Wukong_HRM#CVE_2026_108708#bot", "creation_timestamp": "2026-10-11T01:58:39.601536Z"} {"uuid": "b76f92a1-9f13-4b34-b6f9-877a52cc659a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108708", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117419797317523218", "content": "CVE-2026-108708 Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108708https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_archives_history.pyhttps://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_payroll_card_social_security.pyhttps://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/utils/EmployeeUtil.java#L33-L132https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-missing-authorization-via-employeeaspect-and-employeeutil#WuKongOpenSource #Wukong_HRM#CVE_2026_108708#bot", "creation_timestamp": "2026-10-11T01:58:39.601536Z"} https://vulnerability.circl.lu/sighting/b76f92a1-9f13-4b34-b6f9-877a52cc659a/export Sun, 11 Oct 2026 01:58:39 +0000