CVE-2026-48075

OpenReception’s OpenReception appointment-booking software contains an unauthenticated add-to-tunnel endpoint prior to version 1.0.5. The endpoint accepts any valid tunnelId and any emailHash (even across tunnels) to insert an appointment with status = CONFIRMED, attacker-controlled ciphertext fi...

EUVD-2023-43960

Malicious code in bioql PyPI...

CVE-2023-3285

A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system including admin. This results in unauthorized data manipulation...