WuKongOpenSource
Vulnerability activity for WuKongOpenSource: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.1HighOct 13, 2026WuKongOpenSource Wukong AICRM Auth bypass / access controlCVE-2026-110208Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host.
- 8.8HighOct 13, 2026WuKongOpenSource Wukong AICRM Auth bypass / access controlCVE-2026-110207Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover.
- 8.8HighOct 11, 2026WuKongOpenSource Wukong HRM Auth bypass / access controlCVE-2026-108708Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards and personal data, edit bank cards, and delete employees, departments and contracts company-wide.
- 9.8CriticalOct 11, 2026WuKongOpenSource Wukong HRM Auth bypass / access controlCVE-2026-108707Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
- 5.4MediumOct 11, 2026WuKongOpenSource Wukong AICRM Auth bypass / access controlCVE-2026-108689Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content.
Top products
- Wukong AICRM3 CVEs in the last year
- Wukong HRM2 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.