CVEs
Browse the synced catalog, newest first.
- CVE-2026-124489OpenEMR before 8.3.0 Broken Access Control via portal_payment.phpopenemr
- CVE-2026-124488OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encountersopenemr
- CVE-2026-124487OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docrefopenemr
- CVE-2026-124486OpenEMR before 8.3.0 Missing Authorization in Classic Document Controlleropenemr
- CVE-2026-124485OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents APIopenemr
- CVE-2026-124484OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIsopenemr
- CVE-2026-124483OpenEMR before 8.4.0 Improper Authorization via Prescription REST APIopenemr
- CVE-2026-124482OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launchopenemr
- CVE-2026-124481OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Paymentsopenemr
- CVE-2026-124480OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKENopenemr
- CVE-2026-124479OpenEMR before 8.4.0 Arbitrary File Read via REST Document Downloadopenemr
- CVE-2026-124478OpenEMR before 8.3.0 Missing Authorization via addRecall in save.phpopenemr
- CVE-2026-124477OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.phpopenemr
- CVE-2026-124476OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.phpopenemr
- CVE-2026-124475OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patientopenemr
- CVE-2026-124473OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update APIopenemr
- CVE-2026-124472OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.phpopenemr
- CVE-2026-124471OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.phpopenemr
- CVE-2026-124470OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Listsopenemr
- CVE-2026-124469OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameteropenemr
- CVE-2026-124468OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST APIopenemr
- CVE-2026-124467OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax uploadopenemr
- CVE-2026-124466OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uriopenemr
- CVE-2026-124464OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponseopenemr
- CVE-2026-124463OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print Viewopenemr
- CVE-2026-124462OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameteropenemr
- CVE-2026-124461OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpointopenemr
- CVE-2026-124460OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientControlleropenemr
- CVE-2026-124459OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlersopenemr
- CVE-2026-124458OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpointopenemr