Wukongopensource Wukong Hrm vulnerabilities

2 CVEs affecting Wukongopensource Wukong Hrm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108708, published 2026-10-11.

More from Wukongopensource.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-108707, published 2026-10-11. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN…
• CVE-2026-108708, published 2026-10-11. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all…