CVE-2026-59717: URL Redirection to Untrusted Site

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

PT-2026-69134

Name of the Vulnerable Software and Affected Versions Home Assistant Android Companion app versions prior to 2026.6.1 Description The Android Companion app contains an open redirect issue where the application processes the URL fragment from a homeassistant://invite deep link during the onboardin...

CVE-2026-48074

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...

CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...

EUVD-2026-54258

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...

PT-2026-68736

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.6 Description An issue exists in the appointment booking platform where a TENANT ADMIN can inadvertently delete pending invites belonging to other tenants. When deleting a staff user, the...

SUSE CVE-2026-4273

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a craft...

EUVD-2026-46094

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595

FreeScout prior to v1.8.224 is vulnerable to anonymous account takeover via POST /user-setup/{hash}/{invite_sent_at}. The endpoint authenticates solely by invite_hash; an attacker can overwrite the target account’s email and password and log in without authentication. After activation, invite_has...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

PT-2026-61710

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.224 Description The public endpoint POST /user-setup/hash/invite sent at OpenController@userSetupSave allows an anonymous attacker to overwrite the email and password of the lowest-id activated account and...

CVE-2026-16072 Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

PT-2026-60769

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the organization management component allows a delegated administrator with organization management permissions to bypass security boundaries. The administrator can create an...

CVE-2024-58360

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

CVE-2024-58360 stoatchat before 0.7.8 Unrestricted Account Creation

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

EUVD-2024-55652

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

CVE-2024-58360 stoatchat before 0.7.8 Unrestricted Account Creation

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...

CVE-2024-58360

stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service...