EUVD-2026-54148

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

CVE-2026-48075

OpenReception’s OpenReception appointment-booking software contains an unauthenticated add-to-tunnel endpoint prior to version 1.0.5. The endpoint accepts any valid tunnelId and any emailHash (even across tunnels) to insert an appointment with status = CONFIRMED, attacker-controlled ciphertext fi...

CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...

CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...

CVE-2026-48075

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the "add-to-tunnel" endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid "tunnelId" and a...

CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71445

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71445

The CVE-2026-71445 entry concerns AIL Framework. It describes an authenticated reflected cross-site scripting flaw in the /tag/add_tags endpoint, where an error message is emitted directly as HTML via str(res[0]), allowing attacker-controlled input to be reflected without proper encoding. Exploit...

CVE-2026-19044

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

CVE-2026-28146

CVE-2026-28146 is about an Arbitrary File Download vulnerability in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) , affecting versions up to and including 2.0.14. The connected reports identify the affected product and vulnerability type but do not provid...

CVE-2026-19044 LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

EUVD-2026-53934

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

CVE-2026-19044 LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

CVE-2026-67871

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...

PT-2026-68808

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A reflected cross-site scripting issue exists in the '/tag/add tags' endpoint. When a tag operation fails, the application returns the error value as an HTML response via the strres0...

CVE-2026-48075: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...

PT-2026-68737

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5 Description The add-to-tunnel endpoint allows the creation of new appointment rows in any client tunnel without caller authentication. By providing a valid tunnelId and emailHash, an attacker can insert...

Linux Distros Unpatched Vulnerability : CVE-2026-67870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker...

CVE-2026-70617 Spacebar Server Missing Authorization via Group DM Recipient Endpoint

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...