CVE-2026-52839 is a vulnerability in Easy!Appointments, a self-hosted appointment scheduler, that allows an authenticated provider to inject new appointments into or reassign existing appointments to another provider's schedule. This is due to insufficient validation of the 'id_users_provider' field in the 'appointments/store' and 'appointments/update' endpoints. The issue was patched in version 1.6.0. A [truncated]
CVE-2026-52837 is a vulnerability in Easy!Appointments, a self-hosted appointment scheduler. Versions up to and including 1.5.2 embed the entire customer record as inline JavaScript without authentication or field whitelisting, allowing unauthorized access to customer data via a 12-character appointment hash. This issue affects users of Easy!Appointments who have not upgraded to version 1.6.0 or later.
CVE-2026-42562 is a high-severity authorization flaw in Plainpad that lets a low-privilege authenticated user elevate themselves to administrator. The issue was publicly disclosed on 2026-05-09 and is fixed in Plainpad 1.1.1. Because the vulnerable behavior is reachable over the network by an authenticated account and can immediately unlock admin-only routes, organizations should treat this as a priority [truncated]
