68070 matches found
PT-2026-68742
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description The GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANT ADMIN, exposing the databaseUrl field. This field contains the live PostgreSQL connection string used...
CVE-2026-48080: Exposure of Sensitive Information to an Unauthorized Actor
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...
CVE-2026-48077: Missing Authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...
CVE-2026-65583: Insufficient Verification of Data Authenticity
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...
CVE-2026-19021: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=deleteproduct. Such manipulation of the argument ID leads to sql injection. It is possible to launch the...
PT-2026-68475
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.3 Apache CXF versions prior to 4.1.8 Apache CXF versions prior to 3.6.12 Description OIDC relying-party token validation may accept self-issued ID tokens without enforcing necessary claim checks, including...
PT-2026-68739
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.0 Description The GET handler at the endpoint /api/tenants/id/appointments/appointmentId fails to perform authorization checks. This allows any party with a valid appointment UUID to retrieve the full...
PT-2026-68735
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.4 Description The PIN-type challenge throttle uses emailHash as the sole key within a central challenge throttle table shared across all tenants. This shared architecture allows an attacker who knows a...
CVE-2026-48078: Exposure of Sensitive Information to an Unauthorized Actor
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...
PT-2026-68740
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5 Description The unauthenticated '/api/tenants/id/schedule' endpoint returns all non-archived channels for a tenant, ignoring the isPublic flag. This allows the disclosure of private channels intended to be...
CVE-2026-19064: Authorization Bypass Through User-Controlled Key
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely...
RockyLinux 10 : kernel (RLSA-2026:49871)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49871 advisory. kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID whil...
RockyLinux 8 : kernel-rt (RLSA-2026:49851)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:49851 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 Bug Fixes and Enhancements: Rocky Linux8.10 - KVM: s390: Limit adapter indicator access...
GHSA-42CJ-M3VJ-89WV
creationtimestamp| type| source ---|---|--- 2026-08-05 22:32:39+00:00| seen| https://gist.github.com/alon710/8d9bdd08d5f9d0638cb7af9de6c94fc7 2026-08-06 00:00:18+00:00| seen| https://gist.github.com/alon710/8d9bdd08d5f9d0638cb7af9de6c94fc7...
Exploit for Use of Uninitialized Resource in Linux Linux_Kernel
--- CVE-2026-23003 – Cross‑Chain Bridge Message Forging via...
MINI-8JC3-FHV2-5C6M
Bulletin has no description...
GHSA-WJCP-QJJM-R7W3 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-H7F7-VCPH-W379 vulnerabilities
Vulnerabilities for packages: chromium...