CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,337 CVEs published, 226 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,337
Show in the list
Critical, last 7 days
226
Show in the list
Healthcare-tagged, last 7 days
3
Show in the list
Known exploited (CISA KEV)
1,764
Show in the list

Showing CVEs that name the product open_reception:appointment_booking_software. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

22 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-48080High 8.0OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48071Medium 5.8OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48074Low 2.7OpenReception: Staff deletion removes pending invites cross-tenant by email match
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48075Medium 6.5OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48076Medium 6.5OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48077Medium 5.3OpenReception: GET appointment by ID returns full appointment record without authorization
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48078Medium 5.3OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48079High 7.4OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48081
Healthcare
High 8.1OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer
Assigned by GitHub_M
Aug 6, 2026
CVE-2026-48082Low 3.7OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification
Assigned by GitHub_M
Aug 6, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .