Veille CVE

Octobre 2026

2 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WuKongOpenSource Wukong_HRM » ✕
  1. CVE-2026-108708 8.8 Élevée

    WuKongOpenSource Wukong_HRM

    Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.

  2. CVE-2026-108707 9.8 Critique

    WuKongOpenSource Wukong_HRM

    Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.