{"vulnerability": "cve-2026-5565", "sightings": [{"uuid": "46dd7903-b11a-400b-9316-4b72add1191d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5565", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mir2qih75y2y", "content": "", "creation_timestamp": "2026-04-05T15:26:35.542812Z"}, {"uuid": "3c1e81b1-215a-41c7-89b3-28dadf97488c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5565", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mir5dq7y7m2i", "content": "", "creation_timestamp": "2026-04-05T16:13:08.508805Z"}, {"uuid": "a2b16781-1a22-4438-9ca2-a9fd79ab73e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5565", "type": "published-proof-of-concept", "source": "Telegram/bba5KoRxZjw4aUqHfMWZuI7ux276_2ZWKOY2q9V8MiGPKQ0", "content": "", "creation_timestamp": "2026-04-05T15:16:27.000000Z"}, {"uuid": "56133f08-9d80-4f2b-bb31-628e7dc1eb63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55651", "type": "seen", "source": "https://gist.github.com/alon710/eef1157f11956461ac0859c3d9d6253b", "content": "# CVE-2026-55651: CVE-2026-55651: Excessive Data Exposure and BOLA in Easy!Appointments Customer Search\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55651\n\n## Summary\nAn Excessive Data Exposure vulnerability in Easy!Appointments v1.5.2 allows low-privileged administrative users, such as restricted Providers and Secretaries, to harvest unique, stateless appointment hashes belonging to other providers. These hashes act as capability tokens, granting full authorization to reschedule, take over, or delete appointments via stateless endpoints, resulting in a complete Broken Object Level Authorization (BOLA) scenario.\n\n## TL;DR\nAn authenticated low-privileged user (Provider or Secretary) in Easy!Appointments v1.5.2 can query the customer search endpoint to leak sensitive appointment hashes of other users, allowing subsequent unauthorized cancellation, rescheduling, or takeover of any appointment.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.1 (High)\n- **EPSS Score**: 0.00185 (0.185% probability)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments v1.5.2 installations utilizing multi-provider or multi-secretary setups.\n- **easyappointments**: = 1.5.2 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade Easy!Appointments to version 1.6.0 or later.\n- Manually apply server-side filtering to application/controllers/Customers.php.\n- Disable access to the customer search function for low-privileged accounts if the feature is not strictly required.\n- Implement stricter session verification on public modification endpoints.\n\n**Remediation Steps:**\n1. Backup the Easy!Appointments database and application files.\n2. Download Easy!Appointments version 1.6.0 from the official release page.\n3. Replace the old application directory with the updated code.\n4. Verify the permissions in the Customers.php controller by performing a test search using a low-privileged provider account.\n\n## References\n\n- [CVE-2026-55651 Detail on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-55651)\n- [GitHub Security Advisory GHSA-4vmm-5qvc-w5p7](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55651) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T07:31:43.768839Z"}, {"uuid": "8280ce9e-d847-4144-8b05-607464c6576a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55653", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116797743142261726", "content": "We have just added an important vulnerability affecting OpenSSH (CVE-2026-55653) https://vuldb.com/vuln/372805", "creation_timestamp": "2026-06-23T05:22:15.909358Z"}, {"uuid": "3e0bd4f8-ed80-4c55-bd1b-9fad4fe0ca30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55653", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mowwyqf4kq2l", "content": "CVE-2026-55653 - Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service\nCVE ID : CVE-2026-55653\n \n Published : June 23, 2026, 3:36 a.m. | 4\u00a0hours, 7\u00a0minutes ago\n \n Descri...", "creation_timestamp": "2026-06-23T08:06:45.423481Z"}, {"uuid": "f5b7ae33-d944-4d05-add9-140db3697ebc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55654", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mowwbexkdi2a", "content": "CVE-2026-55654 - Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination\nCVE ID : CVE-2026-55654\n \n Published : June 23, 2026, 3:37 a.m. | 4\u00a0hours, 7\u00a0minutes ago\n \n Description : A flaw ...", "creation_timestamp": "2026-06-23T07:53:41.600340Z"}, {"uuid": "b8a1ed91-90f5-4b27-b697-6741605556d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55655", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mowwprsilu2l", "content": "CVE-2026-55655 - Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions\nCVE ID : CVE-2026-55655\n \n Published : June 23, 2026, 3:36 a.m. | 4\u00a0hours, 7\u00a0minutes ago\n \n Description : A flaw was found in OpenSSH...", "creation_timestamp": "2026-06-23T08:01:45.066595Z"}, {"uuid": "0a92e74e-fd68-453e-95ba-cece397bbde8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55653", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116799021588795788", "content": "Our CTI team identified a lot of activities targeting OpenSSH (CVE-2026-55653) https://vuldb.com/vuln/372805/cti", "creation_timestamp": "2026-06-23T10:47:13.655603Z"}, {"uuid": "442019af-ae96-4063-acad-937bbce60385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55655", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpemrrslna2p", "content": "CVE-2026-55655: A Warning Shot Against Complacency in OpenSSH Security", "creation_timestamp": "2026-06-28T18:41:10.971250Z"}, {"uuid": "b50feef6-d3d7-4740-93a2-9fbc6f6ee350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55655", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpemrstptg2o", "content": "CVE-2026-55655: A Warning Sign of Systemic Oversight in OpenSSH Client Security", "creation_timestamp": "2026-06-28T18:41:12.924123Z"}, {"uuid": "bfc757d2-0650-4384-9dd4-f86225bde601", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55655", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpemrtp46x2u", "content": "CVE-2026-55655: A Local MITM and the Usual Hype Over a Niche Issue", "creation_timestamp": "2026-06-28T18:41:13.684826Z"}, {"uuid": "341bd32e-a9e4-47f3-a1de-203e7b6856f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55655", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpemru6n6a2l", "content": "Fault Lines: Diverging Views on CVE-2026-55655's Threat Landscape", "creation_timestamp": "2026-06-28T18:41:14.313333Z"}, {"uuid": "01384a8e-1875-4aba-bab1-15bfc9ccd8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55659", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqd5lbrpnm2k", "content": "\ud83d\udfe0 CVE-2026-55659 - High (7.7)\n\nGrist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several serv...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55659/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T22:01:38.853735Z"}, {"uuid": "bb0bad6d-61d2-49c3-9998-08446c998090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55659", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkt7jybgz2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55659 \u0432 Grist: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/0F633321-010B-4D41-BCF6-35C2223FA4DB", "creation_timestamp": "2026-07-13T23:17:25.026597Z"}, {"uuid": "dca8d005-334b-4fa2-86a1-fd7d88cb30f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55652", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqpq5txf2q2w", "content": "CVE-2026-55652 - wekan\nAn attacker can gain full access to any Wekan account, including admin accounts, by sending a fake IP address. This can happen if you're using Wekan's header-login feature with trusted IP\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wekan #CVE #infosec", "creation_timestamp": "2026-07-15T22:06:05.534233Z"}, {"uuid": "f9b964f3-270a-4ec7-86f0-09a07172075e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55652", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqpt7o5jtk26", "content": "\ud83d\udd34 CVE-2026-55652 - Critical (9.8)\n\nWekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUS...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55652/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-15T23:00:48.936871Z"}, {"uuid": "419921c8-d24f-4def-aa23-07827414cd43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55652", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqq25nzyeb2x", "content": "CVE-2026-55652 - Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)\nCVE ID : CVE-2026-55652\n \n Published : July 15, 2026, 10:17 p.m. | 17\u00a0minutes ago\n \n Description : Wekan is open source kan...", "creation_timestamp": "2026-07-16T01:04:56.926408Z"}, {"uuid": "9de60ce1-3c2d-4aa2-a087-770184683257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55651", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7", "content": "", "creation_timestamp": "2026-07-29T18:35:25.879822Z"}]}