{"vulnerability": "cve-2026-5284", "sightings": [{"uuid": "f49c506b-a351-4843-8f03-a023b8b784fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miga2zax3r2i", "content": "", "creation_timestamp": "2026-04-01T08:02:40.268691Z"}, {"uuid": "d6892c73-32c8-4e93-b068-ddda6e171555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mih4hjj2sg2m", "content": "", "creation_timestamp": "2026-04-01T16:30:45.781446Z"}, {"uuid": "41c26c26-5e92-48ab-b405-a31e0620c608", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "9a9b1650-b03f-4dcc-a2c7-f966ba4df256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260402", "content": "", "creation_timestamp": "2026-04-01T18:00:00.000000Z"}, {"uuid": "30144d40-ac4a-448e-b0cc-21926cbe709e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0392/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"}, {"uuid": "1f3aad26-f62d-4ce7-8f76-d1fb7d244a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mj7hg4vguk2v", "content": "", "creation_timestamp": "2026-04-11T08:50:44.490598Z"}, {"uuid": "ea3f2298-c0c9-43c9-b274-98ca313ddb3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "fe67ba70-b6cc-47cd-8cbf-07ba108fba1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "bd1a311a-c5af-4bdd-8807-bdfcd2c6f4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5284", "type": "seen", "source": "Telegram/0Pt1cki95fA53ajnnsK8Av3dKVeZdTqxfrxRx4frF74hO10", "content": "", "creation_timestamp": "2026-04-01T15:25:49.000000Z"}, {"uuid": "50ad1c76-019c-44d1-bceb-060cfcfdb131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52841", "type": "seen", "source": "https://gist.github.com/alon710/555463e864b3e92acb0ee1bba5502d4f", "content": "# CVE-2026-52841: CVE-2026-52841: Authorization Bypass in Easy!Appointments Google OAuth Provider Binding\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52841\n\n## Summary\nAn authorization bypass vulnerability exists in Easy!Appointments before version 1.6.0. The application fails to validate ownership of the provider ID during the Google OAuth synchronization process. This allows authenticated backend users to link their personal Google Calendars to peer providers, leading to unauthorized access to scheduled appointments and associated customer metadata.\n\n## TL;DR\nAn authorization bypass flaw in Easy!Appointments allows authenticated backend users to bind their personal Google OAuth token to other providers' profiles, syncing external scheduling metadata and customer PII directly to the attacker's calendar.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.1 (Low)\n- **EPSS Score**: 0.00129\n- **CISA KEV Status**: Not Listed\n- **Exploit Status**: No public PoC\n- **Vulnerable Versions**: < 1.6.0\n\n## Affected Systems\n\n- Easy!Appointments self-hosted appointment scheduler\n- **Easy!Appointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade to Easy!Appointments version 1.6.0 or newer\n- Audit active Google Calendar configuration bindings in the application database\n- Monitor application logs for session state manipulation attempts\n\n**Remediation Steps:**\n1. Apply the software update to version 1.6.0 or newer on your production servers\n2. Verify that the Google.php controller includes the updated authorization check inside the oauth_callback method\n3. Query the ea_settings database table to identify duplicate or unexpected Google sync configurations\n4. Revoke any suspicious or duplicate Google OAuth synchronization tokens\n\n## References\n\n- [GitHub Security Advisory GHSA-8hm4-r66f-29wr](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr)\n- [Easy!Appointments Patch Commit 4b2d245](https://github.com/alextselegidis/easyappointments/commit/4b2d245d2cd2058dc76e05f6eb65b26699268471)\n- [Easy!Appointments 1.6.0 Release Tag](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n- [NVD - CVE-2026-52841 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-52841)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52841) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T03:31:37.463951Z"}, {"uuid": "e6eea675-8680-4734-b931-a86ec16cfd31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52840", "type": "seen", "source": "https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e", "content": "# CVE-2026-52840: CVE-2026-52840: Server-Side Request Forgery in Easy!Appointments CalDAV Connector\n\n> **CVSS Score:** 2.7\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52840\n\n## Summary\nEasy!Appointments prior to version 1.6.0 is vulnerable to Server-Side Request Forgery (SSRF) within its CalDAV integration module. The system handles user-supplied URLs in the connection test endpoint without verifying host constraints or network schemes, allowing authenticated backend users to probe internal infrastructure.\n\n## TL;DR\nAn authenticated SSRF vulnerability in Easy!Appointments prior to 1.6.0 allows backend users to probe internal networks and access loopback and RFC1918 addresses via unvalidated CalDAV connection test requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 2.7\n- **EPSS Score**: 0.00186 (Percentile: 8.49%)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments scheduling platform\n- **easyappointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade Easy!Appointments to version 1.6.0 or higher.\n- Enforce network segmentation and egress filtering rules to prevent the application container from connecting to local and private IP addresses.\n- Audit existing backend accounts to ensure only trusted users hold administrative, provider, or secretary permissions.\n\n**Remediation Steps:**\n1. Download the Easy!Appointments 1.6.0 release package.\n2. Apply the database migrations and update the application files, ensuring the patched `application/libraries/Caldav_sync.php` is deployed.\n3. Verify that the `ENABLE_CALDAV_SSRF_CHECK` parameter or any equivalent toggles are removed from the configurations to maintain secure-by-default logic.\n4. Test the CalDAV connection interface with a loopback address to verify that host validation successfully blocks the request.\n\n## References\n\n- [GHSA-pm5p-7w5h-jm5q Advisory Details](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q)\n- [NVD - CVE-2026-52840 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-52840)\n- [CVE.org CVE-2026-52840 Record](https://www.cve.org/CVERecord?id=CVE-2026-52840)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52840) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T06:31:29.627132Z"}, {"uuid": "0e9c594c-0541-4b7a-b23b-641d8d666d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52846", "type": "published-proof-of-concept", "source": "https://github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v", "content": "", "creation_timestamp": "2026-06-08T22:24:11.000000Z"}, {"uuid": "0eafd9bc-c873-4dc6-8fb1-3af3a4eab02e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52845", "type": "published-proof-of-concept", "source": "https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g", "content": "", "creation_timestamp": "2026-06-08T22:25:00.000000Z"}, {"uuid": "0d44be9d-dd4d-4473-be01-c9d4b26dadc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52844", "type": "published-proof-of-concept", "source": "https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6", "content": "", "creation_timestamp": "2026-06-08T22:24:46.000000Z"}, {"uuid": "cc790936-0072-4144-968d-8e17b38934cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52844", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moy756hrqk2r", "content": "CVE-2026-52844 - Caddy: Windows `file_server` path authorization bypass via encoded backslash\nCVE ID : CVE-2026-52844\n \n Published : June 23, 2026, 5:50 p.m. | 1\u00a0hour, 53\u00a0minutes ago\n \n Description : Caddy is an extensible server platform that uses TLS by default. Prior to 2.1...", "creation_timestamp": "2026-06-23T20:05:07.189195Z"}, {"uuid": "f0da7cd4-6fb3-409a-b61b-17d5fa49f794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52846", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moy7pw3teh25", "content": "CVE-2026-52846 - Caddy: stripHTML template function bypass\nCVE ID : CVE-2026-52846\n \n Published : June 23, 2026, 5:47 p.m. | 1\u00a0hour, 56\u00a0minutes ago\n \n Description : Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy\u2019s stripHTML template fun...", "creation_timestamp": "2026-06-23T20:15:32.838887Z"}, {"uuid": "cf657ec4-1c44-4481-ac92-9431050676b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52845", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moya4fjjjv2t", "content": "CVE-2026-52845 - Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`\nCVE ID : CVE-2026-52845\n \n Published : June 23, 2026, 5:52 p.m. | 1\u00a0hour, 52\u00a0minutes ago\n \n Description : Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4...", "creation_timestamp": "2026-06-23T20:22:31.379265Z"}, {"uuid": "50204c27-0cdd-4011-b12c-e51bf8c63dca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52844", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3moyjjmoi3g2j", "content": "CVE-2026-52844 - Path Traversal in Caddy on Windows. CVSS 7.5. Unauthenticated remote attackers can bypass auth/deny routes protecting /private/*. Fixed in 2.11.4. Update immediately. #CVE #Caddy #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-52844/", "creation_timestamp": "2026-06-23T23:10:58.839661Z"}, {"uuid": "86408728-f049-4928-a384-a0c61e90e8cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52844", "type": "seen", "source": "https://bsky.app/profile/netalexx.bsky.social/post/3moykdgad322x", "content": "CVE-2026-52844 is a critical path traversal vulnerability affecting Caddy", "creation_timestamp": "2026-06-23T23:25:26.472446Z"}, {"uuid": "e15f8fc6-5189-469f-9e7c-d57a0e4f7a8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52843", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqp62h5zb32c", "content": "CVE-2026-52843 - browser\nLightpanda's fetch() and XMLHttpRequest functions shared session cookies with websites from other domains, potentially allowing attackers to access sensitive information. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#browser #lightpandaio #CVE #infosec", "creation_timestamp": "2026-07-15T16:42:04.178745Z"}, {"uuid": "9bf63c86-3ac5-4403-86a9-6b9743f203f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52842", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqp62iew3x2w", "content": "CVE-2026-52842 - browser\nA security flaw in Lightpanda, a tool used for artificial intelligence and automation, could allow hackers to bypass security restrictions. This means that malicious websites\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#browser #lightpandaio #CVE #infosec", "creation_timestamp": "2026-07-15T16:42:05.533092Z"}, {"uuid": "40bef1ba-3341-4251-a6cc-cf2064605d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52847", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpeunqxad2d", "content": "CVE-2026-52847 - mantisbt\nMantisBT 2.28.3 and earlier has a security flaw in its admin installation page. This allows attackers to trick administrators into giving away their login credentials or being\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mantisbt #composer #CVE #infosec", "creation_timestamp": "2026-07-15T18:44:05.811675Z"}, {"uuid": "21b5ee5d-567d-4134-8882-ecf268dd6336", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52843", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpfwtu5la2w", "content": "CVE-2026-52843 - Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode\nCVE ID : CVE-2026-52843\n \n Published : July 15, 2026, 5:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : Lightpanda is a headless browser des...", "creation_timestamp": "2026-07-15T19:03:13.135643Z"}, {"uuid": "727880d5-0595-46d2-a873-e77609802206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52842", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgm3qmkx2s", "content": "CVE-2026-52842 - Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass\nCVE ID : CVE-2026-52842\n \n Published : July 15, 2026, 5:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : Lightpanda is a headless browser designed fo...", "creation_timestamp": "2026-07-15T19:15:07.196549Z"}, {"uuid": "0bdd9165-d404-4a89-bee7-08035a975e9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52845", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrbij277pi2s", "content": "\ud83d\udccc CVE-2026-52845 - Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity... https://www.cyberhub.blog/cves/CVE-2026-52845", "creation_timestamp": "2026-07-22T23:37:07.052722Z"}, {"uuid": "f7265e5f-2876-4569-b25d-441ae005994e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52848", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrmw5a5zbw2x", "content": "\ud83d\udd17 CVE : CVE-2026-47678, CVE-2026-47679, CVE-2026-52848, CVE-2026-53610, CVE-2026-53625, CVE-2026-53629, CVE-2026-55214, CVE-2026-57152", "creation_timestamp": "2026-07-27T12:40:19.681963Z"}, {"uuid": "91218e3c-33bb-4395-985d-2ea206e1ae3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52840", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q", "content": "", "creation_timestamp": "2026-07-29T18:35:23.441191Z"}, {"uuid": "eddf208b-3f17-4f4d-a28e-9e943fe77369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52841", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr", "content": "", "creation_timestamp": "2026-07-29T18:35:16.093651Z"}]}