CVE-2026-48077 OpenReception: GET appointment by ID returns full appointment record without authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

CVE-2026-48076 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: bootstrap-challenge returns a 16-bit PoW challenge with difficulty=4 leading hex zeroes, bootstrap-verify...

EUVD-2026-54144

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...

Malicious code in vite-vue-path-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6841df6c82f556057129d7bf3f23a6cccff9da407678d980875c5529e40caa9 The package is advertised as a Vite plugin that generates a local pathInfo.json map, but its generateBundle hook appends obfuscated JavaScript to the...

CVE-2026-70557

The connected documents confirm a concrete vulnerability in diboot-core: POST /common/load-related-data allows an authenticated user to resolve any caller-supplied field name to any @TableField column across all entities and return those values, because there is no field or entity allowlist and r...

CVE-2026-70557

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677

Anki’s local HTTP server (prior to version 25.09.3) is vulnerable to directory traversal via unconstrained media and built-in data paths. Attackers could leverage scripts served from shared decks or malicious sites with an origin-check bypass to read local files. The issue is fixed in 25.09.3. Af...

CVE-2026-15208

The CVE pertains to the RegistrationMagic WordPress plugin prior to 6.0.9.5. The vulnerability arises because the server-side check only verifies that the PayPal capture status is COMPLETED, without validating the capture amount, currency, payee, or prior use against the target registration. This...

CVE-2026-11976

MonsterInsights Pro updates 10.2.0 and 10.2.2 were distributed from the official update bucket and contain a malicious file, class-system-check.php, due to a compromised AWS S3 bucket. Three distinct variants were observed on 2026-06-11, all using the same AES-256-GCM key, indicating a single thr...

CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows setting a spatiallayerid exceeding the configured number of layers. This causes an out-of-bounds heap rea...

CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/counttokens that bypass the task queue and access ctxserver.vocab directly on HTTP...

CVE-2026-53976

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2026-15246

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...