agentprime: open-reception-appointment-booking-softwareEvery new CVE for open-reception-appointment-booking-software.https://agentprime.io/CVE-2026-75525: OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenanthttps://agentprime.io/advisories/CVE-2026-75525/https://agentprime.io/advisories/CVE-2026-75525/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:42:21 GMTCVECVE-2026-75524: OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agenthttps://agentprime.io/advisories/CVE-2026-75524/https://agentprime.io/advisories/CVE-2026-75524/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:29:52 GMTCVECVE-2026-65825: OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenantshttps://agentprime.io/advisories/CVE-2026-65825/https://agentprime.io/advisories/CVE-2026-65825/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:29:17 GMTCVECVE-2026-65824: OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookiehttps://agentprime.io/advisories/CVE-2026-65824/https://agentprime.io/advisories/CVE-2026-65824/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:27:52 GMTCVECVE-2026-58202: OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`https://agentprime.io/advisories/CVE-2026-58202/https://agentprime.io/advisories/CVE-2026-58202/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:27:36 GMTCVECVE-2026-54460: OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeoverhttps://agentprime.io/advisories/CVE-2026-54460/https://agentprime.io/advisories/CVE-2026-54460/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Sep 2026 20:07:24 GMTCVEcriticalCVE-2026-48088: OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directoryhttps://agentprime.io/advisories/CVE-2026-48088/https://agentprime.io/advisories/CVE-2026-48088/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:34:32 GMTCVEcriticalCVE-2026-48087: OpenReception: WebAuthn passkey injection allows account takeoverhttps://agentprime.io/advisories/CVE-2026-48087/https://agentprime.io/advisories/CVE-2026-48087/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:32:30 GMTCVEcriticalCVE-2026-48086: OpenReception: Tenant admin self-promotes to GLOBAL_ADMINhttps://agentprime.io/advisories/CVE-2026-48086/https://agentprime.io/advisories/CVE-2026-48086/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:30:32 GMTCVEcriticalCVE-2026-48085: OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstraphttps://agentprime.io/advisories/CVE-2026-48085/https://agentprime.io/advisories/CVE-2026-48085/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:29:00 GMTCVEcriticalCVE-2026-48084: OpenReception doesn't rate limit passphrase login attemptshttps://agentprime.io/advisories/CVE-2026-48084/https://agentprime.io/advisories/CVE-2026-48084/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:18:12 GMTCVECVE-2026-48083: OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limitshttps://agentprime.io/advisories/CVE-2026-48083/https://agentprime.io/advisories/CVE-2026-48083/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:16:12 GMTCVECVE-2026-48082: OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplificationhttps://agentprime.io/advisories/CVE-2026-48082/https://agentprime.io/advisories/CVE-2026-48082/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:14:16 GMTCVECVE-2026-48081: OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footerhttps://agentprime.io/advisories/CVE-2026-48081/https://agentprime.io/advisories/CVE-2026-48081/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:10:28 GMTCVECVE-2026-48079: OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryhttps://agentprime.io/advisories/CVE-2026-48079/https://agentprime.io/advisories/CVE-2026-48079/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 21:00:44 GMTCVECVE-2026-48078: OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callershttps://agentprime.io/advisories/CVE-2026-48078/https://agentprime.io/advisories/CVE-2026-48078/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 20:56:24 GMTCVECVE-2026-48077: OpenReception: GET appointment by ID returns full appointment record without authorizationhttps://agentprime.io/advisories/CVE-2026-48077/https://agentprime.io/advisories/CVE-2026-48077/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 20:47:06 GMTCVECVE-2026-48076: OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channelshttps://agentprime.io/advisories/CVE-2026-48076/https://agentprime.io/advisories/CVE-2026-48076/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 20:43:59 GMTCVECVE-2026-48075: OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injectionshttps://agentprime.io/advisories/CVE-2026-48075/https://agentprime.io/advisories/CVE-2026-48075/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 20:39:34 GMTCVECVE-2026-48074: OpenReception: Staff deletion removes pending invites cross-tenant by email matchhttps://agentprime.io/advisories/CVE-2026-48074/https://agentprime.io/advisories/CVE-2026-48074/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 20:27:21 GMTCVECVE-2026-48071: OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockouthttps://agentprime.io/advisories/CVE-2026-48071/https://agentprime.io/advisories/CVE-2026-48071/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 18:46:38 GMTCVECVE-2026-48080: OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deploymenthttps://agentprime.io/advisories/CVE-2026-48080/https://agentprime.io/advisories/CVE-2026-48080/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 18:26:52 GMTCVE