CVE-2026-73529 is a missing rate limiting vulnerability in Plainpad through version 1.1.1, which allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint. This issue arises from dead code in App/Http/Kernel.php that is never instantiated under the Laravel 11+ skeleton, leaving the API throttle configuration unattached to any route. Attackers can exploit this by s [truncated]
CVE-2026-52839 is a vulnerability in Easy!Appointments, a self-hosted appointment scheduler, that allows an authenticated provider to inject new appointments into or reassign existing appointments to another provider's schedule. This is due to insufficient validation of the 'id_users_provider' field in the 'appointments/store' and 'appointments/update' endpoints. The issue was patched in version 1.6.0. A [truncated]
CVE-2026-52837 is a vulnerability in Easy!Appointments, a self-hosted appointment scheduler. Versions up to and including 1.5.2 embed the entire customer record as inline JavaScript without authentication or field whitelisting, allowing unauthorized access to customer data via a 12-character appointment hash. This issue affects users of Easy!Appointments who have not upgraded to version 1.6.0 or later.
CVE-2026-42562 is a high-severity authorization flaw in Plainpad that lets a low-privilege authenticated user elevate themselves to administrator. The issue was publicly disclosed on 2026-05-09 and is fixed in Plainpad 1.1.1. Because the vulnerable behavior is reachable over the network by an authenticated account and can immediately unlock admin-only routes, organizations should treat this as a priority [truncated]
