open-reception appointment-booking-software

• CVE-2026-75525 Medium 5.3 OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant 0.2%
• CVE-2026-75524 Medium 5.4 OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent 0.3%
• CVE-2026-65825 High 7.5 OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants 0.2%
• CVE-2026-65824 High 7.4 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie 0.3%
• CVE-2026-58202 High 8.3 OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` 0.2%
• CVE-2026-54460 Critical 9.8 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover 0.7%
• CVE-2026-48088 Critical 9.4 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory 0.4%
• CVE-2026-48087 Critical 9.8 OpenReception: WebAuthn passkey injection allows account takeover 0.6%
• CVE-2026-48086 Critical 9.9 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN 0.4%
• CVE-2026-48085 Critical 9.8 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap 0.6%
• CVE-2026-48084 High 7.4 OpenReception doesn't rate limit passphrase login attempts 0.4%
• CVE-2026-48083 Medium 6.5 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits 0.4%
• CVE-2026-48082 Low 3.7 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification 0.4%
• CVE-2026-48081 High 8.1 OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer 0.2%
• CVE-2026-48079 High 7.4 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry 0.5%
• CVE-2026-48078 Medium 5.3 OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers 0.3%
• CVE-2026-48077 Medium 5.3 OpenReception: GET appointment by ID returns full appointment record without authorization 0.4%
• CVE-2026-48076 Medium 6.5 OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels 0.3%
• CVE-2026-48075 Medium 6.5 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections 0.4%
• CVE-2026-48074 Low 2.7 OpenReception: Staff deletion removes pending invites cross-tenant by email match 0.3%
• CVE-2026-48071 Medium 5.8 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout 0.4%
• CVE-2026-48080 High 8.0 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment 0.5%