Archive
6 August 2026
Vulnerabilities first published on this day (UTC), newest first.
493 results · Feed
-
Medium 6.5
OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacke…
-
Low 3.7
OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at `/api/tenants/{id}/appointments/bootstrap-challenge` issues a SHA-256 proof-of-work with `d…
-
High —
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
ngx-extended-pdf-viewer embeds a fork of Mozilla's pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json. ### Impact Opening a malicious PDF can execute attacker-controlled JavaScript in t…
-
High —
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context o…
-
High 8.1
OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). The…
-
Medium 4.7
jsoup: Cleaner may expose markup with custom raw-text elements
jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a…
-
Medium 5.1
Frappe Has Broken Access Control in its Workspace Save API
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace a…
-
High 8.8
Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-…
-
High 7.4
OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the `/logout` page, the page's server-side load handler deletes the `access_token` cookie before calli…
-
Medium 5.3
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by <img src="..."> by…
-
Medium 5.3
OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/tenants/{id}/schedule` endpoint returns every non-archived channel for a tenant regardless of the cha…
-
Medium 5.3
OpenReception: GET appointment by ID returns full appointment record without authorization
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/tenants/{id}/appointments/{appointmentId}` performs no authorization check before returning the appoin…
-
Low 2.4
DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting
A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title ca…
-
Medium 6.5
OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty…
-
Medium 5.3
league/commonmark: Denial of service via deeply nested XML output
### Impact `XmlRenderer` pretty-prints XML by emitting depth-proportional indentation whitespace for **every** opening and closing tag. For a tree of depth n, the indentation alone sums to **O(n²)** bytes of output (and corresponding memory), reachable throug…
-
High 7.5
league/commonmark: Denial of service via duplicate footnote definitions
### Impact The Footnote extension records one backref per footnote *reference* and then appends the **entire** backref list for **every** footnote *definition* block in the document, without ever de-duplicating or removing repeated definitions of the same lab…
-
High 7.5
league/commonmark: Denial of service via adjacent inline attribute blocks
### Impact With the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribute node's target by walking outward through its siblings. For a run of N adjacent inline attribute blocks placed at the start of a block (wit…
-
Medium 6.5
OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the `add-to-tunnel` endpoint creates a new appointment row in any client tunnel without any caller authentication. A request th…
-
High 7.5
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan …
-
High 8.3
Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who…
-
High 7.5
Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the rende…
-
Critical 9.6
Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a …
-
High 8.3
Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the …
-
High 8.8
Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code ins…
-
Low 3.1
Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the rend…
-
Critical 9.6
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially pe…
-
High 7.5
Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to insta…
-
Critical 9.6
Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially …
-
Critical 9.6
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker…
-
High 8.3
Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromis…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code …
-
Low 3.1
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the re…
-
Low 3.1
Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the re…
-
High 7.5
Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to enga…
-
High 7.5
Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a u…
-
High 8.1
Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacke…
-
High 7.5
Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to insta…
-
High 8.3
Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the r…
-
High 8.8
Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code insid…
-
High 8.3
Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who ha…