Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
503 results · page 2 of 11
Aug 6, 2026PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton.CVE-2026-71555 · Other software · THM-Health · reported by GitHubMedium 4.1
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
- Product
- PILOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachaCVE-2026-18064 · Other software · NASA · reported by ics-cert@hq.dhs.govHigh 8.2
An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.
- Product
- Core Flight System (cFS) Health & Safety (HS) Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox.CVE-2026-16481 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 6
A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.
- Product
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform).CVE-2026-60172 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.3
Vulnerability in Oracle Autonomous Health Framework (component: Developer triaging platform). Supported versions that are affected are 26.0.0, 26.1.0 and 26.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
- Product
- Oracle Autonomous Health Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-49485 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses CVE-2026-15415 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 6.8
AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research. Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server (aws-healthomics-mcp-server) before version 0.0.36 might allow an actor who can influence the MCP agent to write an actor-controlled content to arbitrary locations outside the intended workflow bundle directory, via directory traversal sequences in the workflow_files input. To remediate this issue, users should upgrade to version 0.0.36 or later.
- Product
- aws-healthomics-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Jul 16, 2026A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS).CVE-2026-15352 · Other software · NASA · reported by ics-cert@hq.dhs.govHigh 8.2
A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.
- Product
- Core Flight System (cFS) Health & Safety (HS) Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-45367 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datCVE-2026-15643 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.2
AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via a crafted next_token parameter. The server does not validate that pagination URLs point back to the expected HealthLake endpoint, allowing an actor to redirect subsequent requests to an actor-controlled server. Its recommended to upgrade to version 0.0.14 or later.
- Product
- awslabs.healthlake-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.compypi.org
Jul 10, 2026Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.CVE-2026-21056 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.8
Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.
- Product
- Samsung Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 8, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-55471 · Other software · hapifhir · reported by GitHubHigh 8.7
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-55470 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation.CVE-2026-12473 · Other software · Open Health Imaging Foundation (OHIF) · reported by ics-cert@hq.dhs.govHigh 8.3
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
- Product
- DICOM Web Viewer Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2026An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measureCVE-2026-50034 · Other software · Apollo Pharmacy · reported by ics-cert@hq.dhs.govHigh 7.1
An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values.
- Product
- Blood Glucose Monitoring System (Model No. APG-01 BT)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comapollopharmacy.in
Jun 18, 2026Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user.CVE-2026-47847 · Other software · Bitnami · reported by security@vmware.comMedium 5.3
Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replication health-check user. The MARIADB_REPLICATION_USER and MARIADB_REPLICATION_PASSWORD environment variables defaulted to monitor and monitor respectively. This user is granted REPLICATION CLIENT privileges from any host ('%'). The Bitnami Helm chart for MariaDB Galera did not expose parameters to configure this user's credentials, resulting in all chart deployments using this publicly known credential by default. Affected versions — Container image: 10.6.x prior to 10.6.27-photon-5-r0; 10.11.x prior to 10.11.17-photon-5-r1; 11.4.x prior to 11.4.12-photon-5-r0; 11.8.x prior to 11.8.7-photon-5-r1; 12.3.x prior to 12.3.2-photon-5-r0 / 12.3.2-debian-12-r0. Helm chart: prior to 18.3.0.
- Product
- bitnami/mariadb-galera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.CVE-2025-69115 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-46518 · Other software · openemr · reported by GitHubHigh 7.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding in multiprintcss_header(), and portal patients can write attacker-controlled HTML directly into patient_data by calling the PUT api/patient/:num endpoint, which bypasses the intended audit review workflow. Because the XSS fires in the clinician's authenticated session on the main OpenEMR interface, the attacker can access CSRF tokens, session data, and perform actions as the clinician — crossing the patient-to-clinician trust boundary. This issue has been patched in version 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a CVE-2026-45642 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.9
Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a depreCVE-2026-0611 · Other software · Spacelabs Healthcare · reported by VulnCheckCritical 9.2
Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by supplying valid .NET URI endpoints. Attackers can write ASPX webshells to the IIS wwwroot directory to achieve unauthenticated remote code execution on the system. Port 8989 is not exposed in a default Sentinel installation; exploitation requires that the .NET Remoting port has been explicitly made network-accessible through deliberate configuration or network policy changes.
- Product
- Sentinel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspacelabshealthcare.comspacelabshealthcare.com
Jun 2, 2026In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probeCVE-2026-3514 · Other software · prefecthq · reported by security@huntr.devHigh 7.5
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This vulnerability can lead to unauthorized access to sensitive information, such as API keys and database credentials, stored in Prefect Variables.
- Product
- prefecthq/prefect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7.CVE-2026-8033 · Other software · PicoTronica · reported by VulDBMedium 5.5
A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the component Response Header Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 5.7.1 mitigates this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- e-Clinic Healthcare System ECHS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
May 6, 2026A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7.CVE-2026-8032 · Other software · PicoTronica · reported by VulDBMedium 5.5
A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. The impacted element is an unknown function of the file /cdemos/echs/priv/echs.js. This manipulation of the argument ADMIN_KEY causes hard-coded credentials. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 5.7.1 is sufficient to resolve this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- e-Clinic Healthcare System ECHS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
May 6, 2026A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7.CVE-2026-8031 · Other software · PicoTronica · reported by VulDBMedium 5.5
A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown function of the file /cdemos/echs/api/v2/patient-records of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 5.7.1 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Product
- e-Clinic Healthcare System ECHS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Apr 4, 2026Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attCVE-2016-20058 · Other software · Netgate · reported by VulnCheckHigh 8.5
Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.
- Product
- NETGATE AMITI Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2026Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escalatCVE-2016-20056 · Other software · Spy-Emergency · reported by VulnCheckHigh 8.5
Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services that allows local attackers to escalate privileges by inserting malicious executables. Attackers can place executable files in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.
- Product
- Spy Emergency
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspy-emergency.comspy-emergency.com
Apr 1, 2026Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request foCVE-2026-4989 · Other software · Devolutions · reported by security@devolutions.netMedium 4.3
Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-34361 · Other software · hapifhir · reported by GitHubCritical 9.3
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), an attacker can steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. This issue has been patched in version 6.9.4.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-34360 · Other software · hapifhir · reported by GitHubMedium 5.8
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation. An unauthenticated attacker with network access to the validator can probe internal network services, cloud metadata endpoints, and map network topology through error-based information leakage. With explore=true (the default for this code path), each request triggers multiple outbound HTTP calls, amplifying reconnaissance capability. This issue has been patched in version 6.9.4.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-34359 · Other software · hapifhir · reported by GitHubHigh 7.4
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server URLs for authentication credential dispatch. Because configured server URLs (e.g., http://tx.fhir.org) lack a trailing slash or host boundary check, an attacker-controlled domain like http://tx.fhir.org.attacker.com matches the prefix and receives Bearer tokens, Basic auth credentials, or API keys when the HTTP client follows a redirect to that domain. This issue has been patched in version 6.9.4.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Gematik Authenticator securely authenticates users for login to digital health applications.CVE-2026-33875 · Other software · gematik · reported by GitHubCritical 9.3
Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update Gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.
- Product
- app-Authenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commachinespirits.com
Mar 27, 2026Gematik Authenticator securely authenticates users for login to digital health applications.CVE-2026-33874 · Other software · gematik · reported by GitHubHigh 7.8
Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version 4.16.0, the Mac OS version of the Authenticator is vulnerable to remote code execution, triggered when victims open a malicious file. Update the gematik Authenticator to version 4.16.0 or greater to receive a patch. There are no known workarounds.
- Product
- app-Authenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commachinespirits.de
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-34056 · Other software · openemr · reported by GitHubHigh 7.7
OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eRx error logs without proper authorization checks. This flaw compromises system confidentiality by exposing sensitive information, potentially leading to unauthorized data disclosure and misuse. As of time of publication, no known patches versions are available.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-34055 · Other software · openemr · reported by GitHubHigh 8.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the legacy patient notes functions in `library/pnotes.inc.php` perform updates and deletes using `WHERE id = ?` without verifying that the note belongs to a patient the user is authorized to access. Multiple web UI callers pass user-controlled note IDs directly to these functions. This is the same class of vulnerability as CVE-2026-25745 (REST API IDOR), but affects the web UI code paths. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-34053 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens belonging to any patient in the system. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-34051 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33934 · Other software · openemr · reported by GitHubMedium 4.3
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization check in `portal/sign/lib/show-signature.php` that allows any authenticated patient portal user to retrieve the drawn signature image of any staff member by supplying an arbitrary `user` value in the POST body. The companion write endpoint (`save-signature.php`) was already hardened against this same issue, but the read endpoint was not updated to match. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33933 · Other software · openemr · reported by GitHubMedium 6.1
OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33932 · Other software · openemr · reported by GitHubHigh 7.6
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scripting vulnerability in the CCDA document preview allows an attacker who can upload or send a CCDA document to execute arbitrary JavaScript in a clinician's browser session when the document is previewed. The XSL stylesheet sanitizes attributes for all other narrative elements but not for `linkHtml`, allowing `href="javascript:..."` and event handler attributes to pass through unchanged. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33931 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the patient portal payment page allows any authenticated portal patient to access other patients' payment records — including invoice/billing data (PHI) and payment card metadata — by manipulating the `recid` query parameter in `portal/portal_payment.php`. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33918 · Other software · openemr · reported by GitHubHigh 7.6
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user — regardless of whether they have billing privileges — to download and permanently delete electronic claim batch files containing protected health information (PHI). Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33917 · Other software · openemr · reported by GitHubHigh 8.8
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax_save page in the CAMOS form. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33915 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insurance company REST API routes are missing the `RestConfig::request_authorization_check()` call that every other data-modifying route in the standard API uses. This allows any authenticated API user to create and modify insurance company records even if their OpenEMR user account does not have administrative ACL permissions. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33914 · Other software · openemr · reported by GitHubHigh 7.2
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the `categoriesUpdate` administrative function. The `dels` POST parameter is read via `pnVarCleanFromInput()`, which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL `DELETE` statement that is executed unsanitized via Doctrine DBAL's `executeStatement()`. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33913 · Other software · openemr · reported by GitHubHigh 7.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing `<xi:include href="file:///etc/passwd" parse="text"/>` to read arbitrary files from the server. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33912 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker could craft a malicious form that, when submitted by a victim, executes arbitrary JavaScript in the victim's browser session. Version 8.0.0.3 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33911 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST parameter `title` is reflected back in a JSON response built with `json_encode()`. Because the response is served with a `text/html` Content-Type, the browser interprets injected HTML/script tags rather than treating the output as JSON. An authenticated attacker can craft a request that executes arbitrary JavaScript in a victim's session. Version 8.0.0.3 contains a fix.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33910 · Other software · openemr · reported by GitHubHigh 7.2
OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33909 · Other software · openemr · reported by GitHubMedium 5.9
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several variables in the MedEx recall/reminder processing code are concatenated directly into SQL queries without parameterization or type casting, enabling SQL injection. Version 8.0.0.3 contains a patch.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33348 · Other software · openemr · reported by GitHubHigh 8.7
OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. Versions prior to 8.0.0.3 have a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.3 contains a patch.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32120 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference (IDOR) vulnerability in the fee sheet product save logic (`library/FeeSheet.class.php`) allows any authenticated user with fee sheet ACL access to delete, modify, or read `drug_sales` records belonging to arbitrary patients by manipulating the hidden `prod[][sale_id]` form field. The `save()` method uses the user-supplied `sale_id` in five SQL queries (SELECT, UPDATE, DELETE) without verifying that the record belongs to the current patient and encounter. Version 8.0.0.3 contains a patch.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.