CVE-2026-55651 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointmen...

CVE-2026-55651 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointmen...

CVE-2026-55651 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointmen...

Security Bulletin: Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Summary The Python Interpreter component and legacy Python REPL Tool component provided flow and agent authors the ability to execute Python code within a scoped globals environment restricted to an operator-configured import allow-list and curated safe builtins. An attacker who could provide inp...

CVE-2026-52837 Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ...,...

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally...

Win32k Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally...

Windows Kernel Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally...

CVE-2026-15389

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CVE-2026-15076

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

CVE-2026-44769

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

CVE-2026-44752 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

PT-2026-58652

Name of the Vulnerable Software and Affected Versions Windows RDP affected versions not specified Description An out-of-bounds read occurs in Windows RDP, which allows an unauthorized attacker to disclose sensitive information over a network. Recommendations At the moment, there is no information...

PT-2026-58115

Name of the Vulnerable Software and Affected Versions Windows Audio Service affected versions not specified Description An issue in the Windows Audio Service allows an authorized attacker to locally disclose sensitive information to an unauthorized actor. Recommendations At the moment, there is n...

PT-2026-58328

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Windows Push Notifications contain a flaw that allows an authorized attacker to locally disclose sensitive information. This issue results in the exposure of push-notification data to...

CVE-2026-52101

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go...

PT-2026-58199

Name of the Vulnerable Software and Affected Versions Windows Trusted Runtime Interface Driver affected versions not specified Description An authorized attacker can locally disclose sensitive information due to an exposure of sensitive data within the Windows Trusted Runtime Interface Driver...

PT-2026-58926

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL rea...

PT-2026-58395

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An issue in Windows Win32K allows an authorized attacker to locally disclose sensitive information to an unauthorized actor, which can affect the system. Recommendations At the moment,...

PT-2026-58044

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description The booking reschedule view at the endpoint /index.php/booking/reschedule/appointment hash handled by the Booking::index function embeds the complete customer record as inline JavaScript...