CVE Tools
Track your stack

Horilla

13 CVEs tracked since 2025. Since Sep 2025, none of them reached CISA KEV.

Horilla CVEs per month

Sep 2025 to Jan 2026. Point at a month, or focus the strip and use the arrow keys.
Horilla CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-0960
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-0170

Products

The products that kept showing up in Horilla's monthly top three, with their CVEs summed over those months.

  1. Horilla132 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Horilla.

  1. CVE-2026-86066Horilla attendance approval endpoint is vulnerable to cross-site request forgery—
  2. CVE-2026-96795Horilla: Authenticated RCE in Horilla List-View Export8.8
  3. CVE-2026-71483Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View—
  4. CVE-2026-63432Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata6.5
  5. CVE-2026-63431Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)6.5
  6. CVE-2026-41513Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints—
  7. CVE-2026-3050horilla-opensource horilla Leads global.js cross site scripting3.5
  8. CVE-2026-3049horilla-opensource horilla Query Parameter global_search.py get redirect4.3
  9. CVE-2026-24039Horilla's Improper Access Control Allows Employees to Auto-Approve Documents4.3
  10. CVE-2026-24038Horilla HR has 2FA Bypass through its OTP Handling Logic8.1
  11. CVE-2026-24037Horilla HRM has XSS Bypass through Project Name4.8
  12. CVE-2026-24036Horilla Exposes Unpublished Job Disclosures through Unauthenticated API5.3
  13. CVE-2026-24035Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee4.3
  14. CVE-2026-24034Horilla has File Upload XSS5.4
  15. CVE-2026-24010Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover8.0

The record

Peak rank
#120 in Sep 2025
Busiest month shown
Jan 2026, 7 CVEs
Months with a KEV entry
0 since Sep 2025
Monthly snapshots
2 since 2025
Horilla's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store