# Aureus ERP vulnerabilities Source: https://junglewise.ai/threats/technologies/aureus-aureus-erp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/aureus-aureus-erp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 6 vulnerabilities in Aureus ERP: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111632, was published on 16 October 2026. 3 vulnerabilities in the last four weeks, level on the four before (3). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 6 - All time: 6 (0 critical, 0 exploited in the wild) ## About Aureus ERP Enterprise Resource Planning (ERP) system for managing business operations and resources. ## Latest Aureus ERP vulnerabilities - [CVE-2026-111632: Aureus ERP authorization bypass in multi-company API](https://junglewise.ai/threats/cve-2026-111632-aureus-erp-through-1-6-0-contains-an-authorization-bypass) (medium, CVSS 5.4, published 16 Oct 2026) - [CVE-2026-111284: Aureus ERP stored cross-site scripting in HolidayAction](https://junglewise.ai/threats/cve-2026-111284-aureus-erp-through-1-6-0-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-110878: Aureus ERP stored cross-site scripting in Inventory Rules](https://junglewise.ai/threats/cve-2026-110878-aureus-erp-through-1-6-0-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-97062: Aureus ERP stored XSS in uploaded SVG files](https://junglewise.ai/threats/cve-2026-97062-aureus-erp-through-1-6-0-stores-uploaded-svg-files-on-its-public) (medium, CVSS 5.4, published 24 Sep 2026) - [CVE-2026-95655: Aureus ERP insufficient message scope validation in ChatterPanel](https://junglewise.ai/threats/cve-2026-95655-aureus-erp-before-1-5-0-fails-to-scope-message-lookups-to-the) (high, CVSS 8.1, published 22 Sep 2026) - [CVE-2026-94387: Aureus ERP stored cross-site scripting in Chatter field-change log](https://junglewise.ai/threats/cve-2026-94387-aureus-erp-before-1-6-0-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 21 Sep 2026) ## Most severe Aureus ERP vulnerabilities - [CVE-2026-95655: Aureus ERP insufficient message scope validation in ChatterPanel](https://junglewise.ai/threats/cve-2026-95655-aureus-erp-before-1-5-0-fails-to-scope-message-lookups-to-the) (high, CVSS 8.1, published 22 Sep 2026) - [CVE-2026-94387: Aureus ERP stored cross-site scripting in Chatter field-change log](https://junglewise.ai/threats/cve-2026-94387-aureus-erp-before-1-6-0-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 21 Sep 2026) - [CVE-2026-110878: Aureus ERP stored cross-site scripting in Inventory Rules](https://junglewise.ai/threats/cve-2026-110878-aureus-erp-through-1-6-0-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-111284: Aureus ERP stored cross-site scripting in HolidayAction](https://junglewise.ai/threats/cve-2026-111284-aureus-erp-through-1-6-0-contains-a-stored-cross-site-scripting) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-97062: Aureus ERP stored XSS in uploaded SVG files](https://junglewise.ai/threats/cve-2026-97062-aureus-erp-through-1-6-0-stores-uploaded-svg-files-on-its-public) (medium, CVSS 5.4, published 24 Sep 2026) - [CVE-2026-111632: Aureus ERP authorization bypass in multi-company API](https://junglewise.ai/threats/cve-2026-111632-aureus-erp-through-1-6-0-contains-an-authorization-bypass) (medium, CVSS 5.4, published 16 Oct 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, level on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Aureus ERP vulnerabilities", https://junglewise.ai/threats/technologies/aureus-aureus-erp, 9 November 2026.