https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T17:08:53.626466+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-85214 CVE-2026-85214 — vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite 2026-10-05T17:08:53.643338+00:00

Affected: lenve vhr

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.