Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

GHSA-2RP4-X2J7-QMCC Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

CVE-2026-48087

OpenReception’s appointment booking software (before v1.0.2) is vulnerable in the /api/auth/register/{userId} flow. The handler validates the WebAuthn challenge against the registration cookie’s email but does not verify that the URL’s userId belongs to that email. An unauthenticated attacker can...

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

EUVD-2026-54173

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

PHP_CodeSniffer gitblame report command injection via crafted filename

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

GHSA-HMQG-CXWW-WQHQ PHP_CodeSniffer gitblame report command injection via crafted filename

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

CVE-2026-67434

PHP_CodeSniffer contains a command-injection vulnerability in the Gitblame/Hgblame/Svnblame report generators prior to versions 3.13.6 and 4.0.2. In untrusted files, a filename with shell metacharacters can cause attacker-controlled commands to execute during report processing. Affected product: ...

CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

CVE-2026-67434

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

CVE-2026-67434 PHP_CodeSniffer gitblame report command injection via crafted filename

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

EUVD-2026-54170

PHPCodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards. Prior to versions 3.13.6 and 4.0.2, PHPCodeSniffer contains a command injection vulnerability in the code that generates the Gitblame, Hgblame, and Svnblame report formats. As a result, running...

CVE-2026-48086

OpenReception’s appointment-booking software (pre‑1.0.2) allows a TENANT_ADMIN to promote themselves to GLOBAL_ADMIN via a single PUT to the role-update handler. The handler accepts GLOBAL_ADMIN from any tenant admin updating their own staff, with no policy enforcing that only an existing GLOBAL_...

CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48086

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

EUVD-2026-54168

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...