AP
Product
appointment-booking-software
22
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 5High 7Medium 8Low 2
Watch
Add appointment-booking-software to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58202 New | 8.3 | Oct 23 | OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` Affected: < 2.0.0 |
| CVE-2026-48081 | 8.1 | Aug 6 | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer Affected: < 1.0.2 |
| CVE-2026-48080 | 8.0 | Aug 6 | OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment Affected: < 1.0.2 |
| CVE-2026-65825 New | 7.5 | Oct 23 | OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants Affected: <= 2.1.0 |
| CVE-2026-65824 New | 7.4 | Oct 23 | OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie Affected: < 2.2.1 |
| CVE-2026-48084 | 7.4 | Aug 6 | OpenReception doesn't rate limit passphrase login attempts Affected: < 1.0.2 |
| CVE-2026-48079 | 7.4 | Aug 6 | OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry Affected: < 1.0.2 |
Showing 7