AP
Product
appointment-booking-software
22
CVEs
0
On KEV
9.9
Max CVSS
5
New 30D
Severity mix
Critical 5High 7Medium 8Low 2
Watch
Add appointment-booking-software to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48083 | 6.5 | Aug 6 | OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits Affected: < 1.0.2 |
| CVE-2026-48076 | 6.5 | Aug 6 | OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels Affected: <= 1.0.1 |
| CVE-2026-48075 | 6.5 | Aug 6 | OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections Affected: < 1.0.5 |
| CVE-2026-48071 | 5.8 | Aug 6 | OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout Affected: < 1.0.4 |
| CVE-2026-75524 New | 5.4 | Oct 23 | OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent Affected: < 2.2.2 |
| CVE-2026-75525 New | 5.3 | Oct 23 | OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant Affected: <= 2.1.0 |
| CVE-2026-48078 | 5.3 | Aug 6 | OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers Affected: < 1.0.5 |
| CVE-2026-48077 | 5.3 | Aug 6 | OpenReception: GET appointment by ID returns full appointment record without authorization Affected: < 1.1.0 |
Showing 8