Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.089 | 5,9 % |
| <10 % | 347.465 | 93,0 % |
Bund sieht bislang keine Schäden durch PHP-Sicherheitslücke - DIE ZEIT
Damit könnten potenziell sehr viele Systeme von der Schwachstelle betroffen sein. Mehr zum Thema. Cybersicherheit. Sicherheitslücke bei PHP: PHP: Was ... Weiterlesen
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026
CVE-2023-28666 | InPost Gallery Plugin up to 2.2.1 on WordPress add_inpost_gallery_slide_item imgurl cross site scripting (EUVD-2023-32327)
A vulnerability described as problematic has been identified in InPost Gallery Plugin up to 2.2.1 on WordPress. This issue affects the function add_inpost_gallery_slide_item. Such manipulation of the argument imgurl leads to cross site scri
CVE-2023-28663 | Formidable PRO2PDF Plugin up to 3.10 on WordPress fpropdf_export_file fieldmap sql injection (EUVD-2023-32324)
A vulnerability was found in Formidable PRO2PDF Plugin up to 3.10 on WordPress. It has been rated as critical. This affects the function fpropdf_export_file. The manipulation of the argument fieldmap leads to sql injection. This vulnerabili
CVE-2023-27536 | libcurl up to 7.x Connection Reuse authentication bypass (FEDORA-2023-7e7414e64d / EUVD-2023-31291)
A vulnerability labeled as problematic has been found in libcurl up to 7.x. Affected by this issue is some unknown functionality of the component Connection Reuse Handler. Such manipulation leads to authentication bypass by primary weakness
CVE-2023-27534 | Oracle Hyperion Infrastructure Technology 11.2.14.0.000 path traversal (EUVD-2023-31289 / Nessus ID 238296)
A vulnerability, which was classified as critical, was found in Oracle Hyperion Infrastructure Technology 11.2.14.0.000. Affected by this vulnerability is an unknown functionality of the component Infrastructure. The manipulation results in
CVE-2023-27463 | Siemens RUGGEDCOM CROSSBOW up to 5.2 Audit Log Form sql injection (ssa-320629)
A vulnerability has been found in Siemens RUGGEDCOM CROSSBOW up to 5.2 and classified as critical. This affects an unknown function of the component Audit Log Form. This manipulation causes sql injection. This vulnerability is tracked as CV
CVE-2023-27405 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds (ssa-847261)
A vulnerability marked as problematic has been reported in Siemens Tecnomatix Plant Simulation 16.0.5. Impacted is an unknown function of the component SPP File Handler. Performing a manipulation results in out-of-bounds read. This vulnerab
CVE-2022-47924 | Secvisogram csaf-validator-lib prior 0.1.0 Arguments denial of service (bsi-2022-0004)
A vulnerability was found in Secvisogram csaf-validator-lib and classified as problematic. Affected by this issue is some unknown functionality of the component Arguments Handler. Such manipulation leads to denial of service. This vulnerabi
CVE-2026-94075 | Tribulant Newsletters Plugin up to 4.18.1 on WordPress deserialization (EUVD-2026-109249)
A vulnerability classified as critical was found in Tribulant Newsletters Plugin up to 4.18.1 on WordPress. Impacted is an unknown function. The manipulation results in deserialization. This vulnerability is known as CVE-2026-94075. It is p
CVE-2026-112869 | Noah Hearle We’re Open! Plugin up to 2.6 on WordPress cross site scripting (EUVD-2026-109248)
A vulnerability was found in Noah Hearle We’re Open! Plugin up to 2.6 on WordPress. It has been rated as problematic. This impacts an unknown function. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026
CVE-2026-114190 | LiteSpeed Cache Plugin up to 7.9 on WordPress information disclosure (EUVD-2026-109251)
A vulnerability, which was classified as problematic, was found in LiteSpeed Cache Plugin up to 7.9 on WordPress. This issue affects some unknown processing. The manipulation results in information disclosure. This vulnerability was named C
CVE-2026-112866 | WPFactory Product Filter by WBW Plugin up to 3.4.6 on WordPress sql injection (EUVD-2026-109250)
A vulnerability has been found in WPFactory Product Filter by WBW Plugin up to 3.4.6 on WordPress and classified as critical. Impacted is an unknown function. This manipulation causes sql injection. The identification of this vulnerability
CVE-2026-114697 | QuarkA QA Analytics Plugin up to 5.3.0.1 on WordPress cross site scripting (EUVD-2026-109253)
A vulnerability marked as problematic has been reported in QuarkA QA Analytics Plugin up to 5.3.0.1 on WordPress. This affects an unknown part. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE
CVE-2026-114178 | Bold Grid W3 Total Cache Plugin up to 2.10.7 on WordPress cross site scripting (EUVD-2026-109252)
A vulnerability was found in Bold Grid W3 Total Cache Plugin up to 2.10.7 on WordPress. It has been declared as problematic. This affects an unknown function. Executing a manipulation can lead to cross site scripting. This vulnerability is
CVE-2026-110892 | Brainstorm Force SureDash Plugin up to 1.12.2 on WordPress authorization (EUVD-2026-109254)
A vulnerability, which was classified as problematic, has been found in Brainstorm Force SureDash Plugin up to 1.12.2 on WordPress. This vulnerability affects unknown code. The manipulation leads to missing authorization. This vulnerability
CVE-2026-114694 | Pixelite Events Manager Plugin up to 7.4.8 on WordPress cross site scripting (EUVD-2026-109256)
A vulnerability labeled as problematic has been found in Pixelite Events Manager Plugin up to 7.4.8 on WordPress. Affected by this issue is some unknown functionality. Such manipulation leads to cross site scripting. This vulnerability is d
CVE-2026-114693 | Plugins360 Labs All-in-One Video Gallery Plugin up to 4.9.7 on WordPress cross site scripting (EUVD-2026-109255)
A vulnerability classified as problematic has been found in Plugins360 Labs All-in-One Video Gallery Plugin up to 4.9.7 on WordPress. This issue affects some unknown processing. The manipulation leads to cross site scripting. This vulnerabi
CVE-2026-114695 | Infomaniak Network Vod Infomaniak Plugin up to 1.5.14 on WordPress cross site scripting (EUVD-2026-109257)
A vulnerability identified as problematic has been detected in Infomaniak Network Vod Infomaniak Plugin up to 1.5.14 on WordPress. Affected by this vulnerability is an unknown functionality. This manipulation causes cross site scripting. Th
CVE-2026-114196 | Paytiumsupport Paytium Plugin up to 5.0.5 on WordPress deserialization (EUVD-2026-109258)
A vulnerability described as critical has been identified in Paytiumsupport Paytium Plugin up to 5.0.5 on WordPress. This vulnerability affects unknown code. Executing a manipulation can lead to deserialization. This vulnerability appears a
CVE-2026-115993 | CervantesSec Cervantes up to 1.3-beta Notes cross site scripting (EUVD-2026-109259)
A vulnerability, which was classified as problematic, has been found in CervantesSec Cervantes up to 1.3-beta. The affected element is an unknown function of the component Notes. This manipulation causes cross site scripting. This vulnerabi
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describ
CVE-2023-27404 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File stack-based overflow (ssa-847261)
A vulnerability labeled as critical has been found in Siemens Tecnomatix Plant Simulation 16.0.5. This issue affects some unknown processing of the component SPP File Handler. Such manipulation leads to stack-based buffer overflow. This vul
CVE-2023-27403 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File memory corruption (ssa-847261)
A vulnerability identified as critical has been detected in Siemens Tecnomatix Plant Simulation 16.0.5. This vulnerability affects unknown code of the component SPP File Handler. This manipulation causes memory corruption. This vulnerabilit
CVE-2023-27402 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds (ssa-847261)
A vulnerability was found in Siemens Tecnomatix Plant Simulation 16.0.5. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SPP File Handler. The manipulation leads to out-of-bounds read.
CVE-2023-27310 | Siemens RUGGEDCOM CROSSBOW up to 5.1 Client Query authorization (ssa-260625)
A vulnerability, which was classified as critical, has been found in Siemens RUGGEDCOM CROSSBOW up to 5.1. The affected element is an unknown function of the component Client Query Handler. The manipulation leads to missing authorization. T
CVE-2023-25957 | Siemens Mendix SAML up to 3.2.3 incorrect implementation of authentication algorithm (ssa-851884)
A vulnerability classified as critical has been found in Siemens Mendix SAML up to 3.2.3. This issue affects some unknown processing. Performing a manipulation results in incorrect implementation of authentication algorithm. This vulnerabil
CVE-2023-23916 | cURL up to 7.87.x HTTP Compression allocation of resources (DLA 3341-1 / Nessus ID 215380)
A vulnerability, which was classified as problematic, has been found in cURL up to 7.87.x. Affected by this vulnerability is an unknown functionality of the component HTTP Compression Handler. The manipulation leads to allocation of resourc
CVE-2023-22972 | OpenEMR up to 6.x eye_mag_functions.php REQUEST_URI cross site scripting (EUVD-2023-27072)
A vulnerability identified as problematic has been detected in OpenEMR up to 6.x. The impacted element is an unknown function of the file interface/forms/eye_mag/php/eye_mag_functions.php. The manipulation of the argument REQUEST_URI leads
CVE-2023-24995 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability has been found in Siemens Tecnomatix Plant Simulation 16.0.5 and classified as critical. The impacted element is an unknown function of the component SPP File Handler. This manipulation causes out-of-bounds write. The identi
CVE-2023-24993 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability, which was classified as critical, has been found in Siemens Tecnomatix Plant Simulation 16.0.5. Impacted is an unknown function of the component SPP File Handler. The manipulation leads to out-of-bounds write. This vulnerab
CVE-2023-24989 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability marked as critical has been reported in Siemens Tecnomatix Plant Simulation 16.0.5. Affected by this issue is some unknown functionality of the component SPP File Handler. This manipulation causes out-of-bounds write. This v
CVE-2023-24987 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability identified as critical has been detected in Siemens Tecnomatix Plant Simulation 16.0.5. Affected is an unknown function of the component SPP File Handler. The manipulation leads to out-of-bounds write. This vulnerability is
CVE-2023-24984 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability was found in Siemens Tecnomatix Plant Simulation 16.0.5. It has been declared as critical. The impacted element is an unknown function of the component SPP File Handler. Such manipulation leads to out-of-bounds write. This v
CVE-2023-24982 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability was found in Siemens Tecnomatix Plant Simulation 16.0.5 and classified as critical. Impacted is an unknown function of the component SPP File Handler. The manipulation results in out-of-bounds write. This vulnerability is id
CVE-2023-24981 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability has been found in Siemens Tecnomatix Plant Simulation 16.0.5 and classified as critical. This issue affects some unknown processing of the component SPP File Handler. The manipulation leads to out-of-bounds write. This vulne
CVE-2023-24980 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability, which was classified as critical, was found in Siemens Tecnomatix Plant Simulation 16.0.5. This vulnerability affects unknown code of the component SPP File Handler. Executing a manipulation can lead to out-of-bounds write.
CVE-2023-24979 | Siemens Tecnomatix Plant Simulation 16.0.5 SPP File out-of-bounds write (ssa-847261)
A vulnerability, which was classified as critical, has been found in Siemens Tecnomatix Plant Simulation 16.0.5. This affects an unknown part of the component SPP File Handler. Performing a manipulation results in out-of-bounds write. This
CVE-2023-24581 | Siemens Solid Edge SE2022/Solid Edge SE2023 STP File use after free (ssa-491245)
A vulnerability classified as critical has been found in Siemens Solid Edge SE2022 and Solid Edge SE2023. Affected by this vulnerability is an unknown functionality of the component STP File Handler. This manipulation causes use after free.
CVE-2026-115929 | MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1
CVE-2026-115931 | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, in
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be rea
CVE-2026-115938 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists. The vulnerable condition value is ultimately cast to an integer. That does not protect the
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper,
CVE-2026-115937 | The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash. Commerce queries Mollie, sees status: paid,
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which
CVE-2026-115801 | A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: "khaiii treats the resource dir
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the ar
CVE-2026-115935 | The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a T
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this
CVE-2026-115897 | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialize
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influ
CVE-2026-115895 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it is a JavaScript binding identifier before inserting it into a generated destructuring binding. With enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can use an invalid alias that becomes a vali
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it
CVE-2026-115893 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This iss
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditio
CVE-2026-115892 | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns through StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader. A malicious guest that controls exported function types or returned values can cause the host to pass the type-erased value to a guest e
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns t
CVE-2026-115889 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on a
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wa
CVE-2026-115887 | GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver a
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponent
CVE-2026-115886 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When option
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-ap
CVE-2026-115885 | The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image re
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess h
CVE-2026-115883 | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their
LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, Sql
CVE-2026-75525 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writable, so that
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's iden
CVE-2026-115800 | A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_file l
CVE-2026-75524 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is des
CVE-2026-65825 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel, which holds their end-to-end-encrypted appointment data, and the ability to act as the client, for example adding or can
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online in the victim tenant. A successfu
CVE-2026-65824 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential an
CVE-2026-58202 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker who sends one resend-confirmation with Host: attacker.example and
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The unauth