Which function in open-reception/appointment-booking-software has been patched by the most CVEs?

filter in src/routes/api/tenants/[id]/schedule/+server.ts has been changed by 2 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in open-reception/appointment-booking-software?

The median fix changes 38 lines. 31% of fixes change 20 lines or fewer, and 38% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

sql

#350 of 500 repositories

open-reception/appointment-booking-software

Name: open-reception/appointment-booking-software: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 17, 2026

16

CVE fixes located

Published CVEs

25

Functions patched

Distinct function sites

33

Files patched

Distinct source files

2026

Years covered

By CVE publication date

Overview

16 published CVEs have a fix traced to functions in open-reception/appointment-booking-software, the earliest published in 2026. Those fixes changed 25 distinct functions across 33 files, in 150 patch hunks.

Among the 500 repositories tracked here, open-reception/appointment-booking-software ranks #350 by the number of CVEs with a located fix.

Most patched functions

Functions in open-reception/appointment-booking-software changed by the most CVE fixes.

Most patched files

Files in open-reception/appointment-booking-software changed by the most CVE fixes.

1src/lib/utils/passkey.ts2 CVEs · 4 functions
2src/routes/api/tenants/[id]/appointments/add-to-tunnel/+server.ts2 CVEs · 2 functions
3src/routes/api/tenants/[id]/staff/[staffId]/crypto/+server.ts2 CVEs · 2 functions
4src/lib/client/appointment-crypto.ts2 CVEs · 1 functions
5src/routes/api/tenants/[id]/schedule/+server.ts2 CVEs · 1 functions
6src/routes/(pages)/confirm/setup-passkey/setup-passkey-form.svelte2 CVEs · 1 functions
7src/routes/api/auth/register/[id]/+server.ts2 CVEs · 0 functions
8src/routes/api/tenants/[id]/appointments/[appointmentId]/+server.ts2 CVEs · 0 functions
9src/routes/(pages)/confirm/[token]/+page.server.ts1 CVEs · 2 functions
10src/lib/server/auth/registration-bootstrap.ts1 CVEs · 1 functions

Fix size

How much code a CVE fix in open-reception/appointment-booking-software changes, with backports counted once.

38

Median lines changed

Added plus removed, per CVE

31%

Fixes of 20 lines or fewer

Share of CVE fixes

38%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in open-reception/appointment-booking-software, and the functions each fix changed.

OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover
CVE-2026-54460
Critical · CVSS 9.8
EPSS 0.7%2026-09-17
OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory
CVE-2026-48088SelectNotification string select
Critical · CVSS 9.4
EPSS 0.4%2026-08-06
OpenReception: WebAuthn passkey injection allows account takeover
CVE-2026-48087getUserById
Critical · CVSS 9.8
EPSS 0.6%2026-08-06
OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
CVE-2026-48086
Critical · CVSS 9.9
EPSS 0.4%2026-08-06
OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
CVE-2026-48085
Critical · CVSS 9.8
EPSS 0.6%2026-08-06
OpenReception doesn't rate limit passphrase login attempts
CVE-2026-48084ThrottleType
High · CVSS 7.4
EPSS 0.4%2026-08-06
OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits
CVE-2026-48083replace
Medium · CVSS 6.5
EPSS 0.4%2026-08-06
OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification
CVE-2026-48082createBootstrapBinding
Low · CVSS 3.7
EPSS 0.4%2026-08-06
OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer
CVE-2026-48081TenantAdminService union
High · CVSS 8.1
EPSS 0.2%2026-08-06
OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry
CVE-2026-48079fetch
High · CVSS 7.4
EPSS 0.5%2026-08-06
OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
CVE-2026-48078filter
Medium · CVSS 5.3
EPSS 0.3%2026-08-06
OpenReception: GET appointment by ID returns full appointment record without authorization
CVE-2026-48077
Medium · CVSS 5.3
EPSS 0.4%2026-08-06

Get an alert for each new open-reception/appointment-booking-software CVE, with the patched functions and AI-written analysis.

Monitor appointment-booking-software CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Alinto/sogo16 CVEs android.googlesource.com/platform-system-bt16 CVEs argoproj/argo-workflows16 CVEs codeigniter4/CodeIgniter416 CVEs debian/libmatio16 CVEs debian/libvncserver16 CVEs debian/netatalk16 CVEs debian/nss16 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in open-reception/appointment-booking-software.

How many CVEs have a located fix in open-reception/appointment-booking-software?: 16 published CVEs have a fix traced to functions in open-reception/appointment-booking-software, touching 25 functions across 33 files.
Which function in open-reception/appointment-booking-software has been patched by the most CVEs?: filter in src/routes/api/tenants/[id]/schedule/+server.ts has been changed by 2 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in open-reception/appointment-booking-software?: The median fix changes 38 lines. 31% of fixes change 20 lines or fewer, and 38% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track open-reception/appointment-booking-software CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing