vhr vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

VH

Product

vhr

by lenve · last CVE Oct 13, 2026

8

CVEs

0

On KEV

8.1

Max CVSS

1

New 30D

Vulnerabilities8 In the news0 Timeline

Severity mix

Critical 0High 3Medium 5Low 0

Severity

All severities8 Critical0 High3 Medium5 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add vhr to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-85214	8.1	1%	Sep 3	vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite Affected: through 03abbd35af24e55368ce4e09f4038dc2aba3ff5f
CVE-2026-85182	7.5	0%	Sep 3	vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change Affected: through 03abbd35af24e55368ce4e09f4038dc2aba3ff5f
CVE-2026-90498	7.3	0%	Sep 13	lenve vhr vhr.sql default credentials Affected: 1.0-SNAPSHOT
CVE-2026-110217	6.5	1%	Oct 13	vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs Affected: through 03abbd35af24e55368ce4e09f4038dc2aba3ff5f
CVE-2026-90501	6.3	0%	Sep 13	lenve vhr HrMapper.xml HrInfoController.updateHr privileges management Affected: 1.0-SNAPSHOT
CVE-2026-90500	6.3	0%	Sep 13	lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload Affected: 1.0-SNAPSHOT
CVE-2026-90490	6.3	0%	Sep 13	lenve vhr MailReceiver deserialization Affected: 1.0-SNAPSHOT
CVE-2026-90499	5.4	0%	Sep 13	lenve vhr Password Update pass HrInfoController.updatePass improper authorization Affected: 1.0-SNAPSHOT