CVE-2026-14202

MediumCVSS 5.3/10Last modified Oct 23, 2026

Description

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting.

This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

VendorProductVersions
Bilin Software and Informatics Consultancy Inc.HUMANIST Digital Human Resources>= 26.0, < 26.1

References

Timeline

Published
Aug 4, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-142034.8The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its maCVE-2026-142046.5The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to tCVE-2026-142059.8The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes CVE-2026-142067.5The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft,CVE-2026-142076.1The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and renderCVE-2026-142087.3Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities -CVE-2026-142094.3A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. WhCVE-2026-14215.4A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. SCVE-2026-142104.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 tCVE-2026-142113.8The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is rCVE-2026-142124.7The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) ownsCVE-2026-142133.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is
CVE-2026-14202: Medium severity, CVSS 5.3 | Vulnix