Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
503 results · page 3 of 11
Mar 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-29187 · Other software · openemr · reported by GitHubHigh 8.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.CVE-2026-33180 · Other software · hapifhir · reported by GitHubHigh 7.5
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
- Product
- org.hl7.fhir.core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comaccess.redhat.com
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33346 · Other software · openemr · reported by GitHubHigh 8.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. The payload is stored via `portal/lib/paylib.php` and rendered without escaping in `portal/portal_payment.php`. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33321 · Other software · openemr · reported by GitHubHigh 7.2
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in the PDF creation function where the form answers are parsed as unescaped HTML, allowing an attacker to forge requests from the server made to external or internal resources. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33305 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows any authenticated OpenEMR user to invoke controller methods — including `getNotificationLog()`, which returns patient appointment data (PHI) — regardless of whether they hold the required ACL permissions. The `AppDispatch` constructor dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33304 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the dated reminders log allows any authenticated non-admin user to view reminder messages belonging to other users, including associated patient names and free-text message content, by crafting a GET request with arbitrary user IDs in the `sentTo[]` or `sentBy[]` parameters. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33303 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cross-site scripting (XSS) via unescaped `portal_login_username` in the portal credential print view. A patient portal user can set their login username to an XSS payload, which then executes in a clinic staff member's browser when they open the "Create Portal Login" page for that patient. This crosses from the patient session context into the staff/admin session context. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33302 · Other software · openemr · reported by GitHubHigh 7.3
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function `AclMain::zhAclCheck()` only checks for the presence of any "allow" (user or group). It never checks for explicit "deny" (allowed=0). As a result, administrators cannot revoke access by setting a user or group to "deny"; if the user is in a group that has "allow," access is granted regardless of explicit denies. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33301 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read vulnerability was identified in the PDF creation function where the form answers are parsed as unescaped HTML, allowing an attacker to include arbitrary image files from the server in the generated PDF. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-33299 · Other software · openemr · reported by GitHubHigh 8.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill **Eye Exam** forms in patient encounters. The answers to the form are displayed on the encounter page and in the visit history for the users with the same role. There exists a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32238 · Other software · openemr · reported by GitHubCritical 9.1
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32119 · Other software · openemr · reported by GitHubMedium 4.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`) allows an authenticated user with encounter form write access to inject arbitrary JavaScript that executes in another clinician's browser session when they use the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25928 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25744 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an `id` in the request body and treats it as an UPDATE. There is no verification that the vital belongs to the current patient or encounter. An authenticated user with encounters/notes permission can overwrite any patient's vitals by supplying another patient's vital `id`, leading to medical record tampering. Version 8.0.0.2 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25745 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/note update endpoint (e.g. PUT or POST) updates by message/note ID only and does not verify that the message belongs to the current patient (or that the user is allowed to edit that patient’s notes). An authenticated user with notes permission can modify any patient’s messages by supplying another message ID. Commit 92a2ff9eaaa80674b3a934a6556e35e7aded5a41 contains a fix for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2026A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android.CVE-2026-4250 · Other software · Albert Sağlık Hizmetleri ve Ticaret · reported by VulDBLow 1.1
A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/assets/service-account.json of the component Google Cloud Service Account Key Handler. Performing a manipulation results in unprotected storage of credentials. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Albert Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32127 · Other software · openemr · reported by GitHubHigh 8.8
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax graphs library. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32126 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own internal authorization (review, log), while leaving all other CDR controllers — alerts, ajax, edit, add, detail, browse — accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts system-wide, delete or modify clinical plans, and edit rule configurations — all operations intended to require administrator privileges. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32125 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names from the Track Anything feature are stored from user input (POST) and later rendered in Dygraph charts (titles/labels) using innerHTML or equivalent without escaping. A user who can create or edit Track Anything items can inject script that runs when any user views the corresponding graph. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32124 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code picker AJAX endpoint returns code descriptions (code_text) that are rendered in the front end (e.g. DataTables) without HTML escaping. If an administrator (or user with code management rights) creates or edits a code with a malicious description containing script, that script runs in the browser of every user who uses the picker. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32123 · Other software · openemr · reported by GitHubHigh 7.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, sensitivity checks for group encounters are broken because the code only consults form_encounter for sensitivity, while group encounters store sensitivity in form_groups_encounter. As a result, sensitivity is never correctly applied to group encounters, and users who should be restricted from viewing sensitive (e.g. mental health) encounters can view them. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32122 · Other software · openemr · reported by GitHubMedium 4.3
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the Claim File Tracker feature exposes an AJAX endpoint that returns billing claim metadata (claim IDs, payer info, transmission logs). The endpoint does not enforce the same ACL as the main billing/claims workflow, so authenticated users without appropriate billing permissions can access this data. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32121 · Other software · openemr · reported by GitHubHigh 7.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves client-side DOM-based rendering via jQuery .html() in a completely different component (portal/sign/assets/signer_api.js). The two share the same root cause (unsanitized patient names in patient_data), but they have different sinks, different affected components, different trigger actions, and require independent fixes. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-32118 · Other software · openemr · reported by GitHubMedium 5.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, stored cross-site scripting (XSS) in the Graphical Pain Map ("clickmap") form allows any authenticated clinician to inject arbitrary JavaScript that executes in the browser of every subsequent user who views the affected encounter form. Because session cookies are not marked HttpOnly, this enables full session hijacking of other users, including administrators. This vulnerability is fixed in 8.0.0.1.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026MediCenter - Health Medical Clinic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28137 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Reflected XSS.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 14.9.
- Product
- MediCenter - Health Medical Clinic
- Affected
- up to 14.9
- What to do
- Affects up to 14.9. Update MediCenter - Health Medical Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25146 · Other software · openemr · reported by GitHubCritical 9.6
OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24898 · Other software · openemr · reported by GitHubCritical 10
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24848 · Other software · openemr · reported by GitHubHigh 8.7
OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary locations on the server filesystem. This vulnerability can be exploited to achieve Remote Code Execution (RCE) by uploading malicious PHP web shells.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25147 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in `portal/portal_payment.php`, the patient id used for the page is taken from the request (`$pid = $_REQUEST['pid'] ?? $pid` and `$pid = ($_REQUEST['hidden_patient_code'] ?? null) > 0 ? $_REQUEST['hidden_patient_code'] : $pid`) instead of being fixed to the authenticated portal user. The portal session already has a valid `$pid` for the logged-in patient. Overwriting it with user-supplied values and using it without authorization allows a portal user to view and interact with another patient's demographics, invoices, and payment history—horizontal privilege escalation and IDOR. Version 8.0.0 contains a fix for the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24488 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary file exfiltration vulnerability in the fax sending endpoint allows any authenticated user to read and transmit any file on the server (including database credentials, patient documents, system files, and source code) via fax to an attacker-controlled phone number. The vulnerability exists because the endpoint accepts arbitrary file paths from user input and streams them to the fax gateway without path restrictions or authorization checks. As of time of publication, no known patched versions are available.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.CVE-2025-15567 · Other software · vivo · reported by security@vivo.comMedium 5.1
Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.
- Product
- Health
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-27943 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam (eye_mag) view loads data by `form_id` (or equivalent) without verifying that the form belongs to the current user’s patient/encounter context. An authenticated user can access or edit any patient’s eye exam by supplying another form ID; in some flows the session’s active patient may also be switched. A fix is available on the `main` branch of the OpenEMR GitHub repository.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25930 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-Based Form (LBF) printable view accepts `formid` and `visitid` (or `patientid`) from the request and does not verify that the form belongs to the current user’s authorized patient/encounter. An authenticated user with LBF access can enumerate form IDs and view or print any patient’s encounter forms. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25929 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `patient_picture` context serves the patient’s photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient’s ID and retrieve their photo. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25927 · Other software · openemr · reported by GitHubHigh 7.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e.g. upload or state save/load) accepts a document ID (`doc_id`) without verifying that the document belongs to the current user’s authorized patient or encounter. An authenticated user can read or modify DICOM viewer state (e.g. annotations, view settings) for any document by enumerating document IDs. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25746 · Other software · openemr · reported by GitHubHigh 8.8
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the prescription listing functionality. Version 8.0.0 fixes the vulnerability.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25743 · Other software · openemr · reported by GitHubHigh 7.2
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, users with the "Forms administration" role can fill questionnaires ("forms") in patient encounters. The answers to the forms are displayed on the encounter page and in the visit history for the users with the same role. There exists a stored cross-site scripting (XSS) vulnerability in the function to display the form answers, allowing any authenticated attacker with the specific role to insert arbitrary JavaScript into the system by entering malicious payloads to the form answers. The JavaScript code is later executed by any user with the form role when viewing the form answers in the patient encounter pages or visit history. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25476 · Other software · openemr · reported by GitHubHigh 7.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in `library/auth.inc.php` runs only when `skip_timeout_reset` is not present in the request. When `skip_timeout_reset=1` is sent, the entire block that calls `SessionTracker::isSessionExpired()` and forces logout on timeout is skipped. As a result, any request that includes this parameter (e.g. from auto-refresh pages like the Patient Flow Board) never runs the expiration check: expired sessions can continue to access data indefinitely, abandoned workstations stay active, and an attacker with a stolen session cookie can keep sending `skip_timeout_reset=1` to avoid being logged out. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25220 · Other software · openemr · reported by GitHubMedium 5.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the URL parameter `show_all=yes` and passes it to `getPnotesByUser()`, which returns all internal messages (all users’ notes). The backend does not verify that the requesting user is an administrator before honoring `show_all=yes`. The "Show All" link is also visible to non-admin users. As a result, any authenticated user can view the entire internal message list by requesting `messages.php?show_all=yes`. Version 8.0.0 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25164 · Other software · openemr · reported by GitHubHigh 8.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorization_check()` for the document and insurance routes. Other patient routes in the same file (e.g. encounters, patients/med) call it with the appropriate ACL. As a result, any valid API bearer token can access or modify every patient's documents and insurance data, regardless of the token’s OpenEMR ACLs—effectively exposing all document and insurance PHI to any authenticated API client. Version 8.0.0 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24908 · Other software · openemr · reported by GitHubCritical 9.9
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the `_sort` parameter. This could potentially lead to database access, PHI (Protected Health Information) exposure, and credential compromise. The issue occurs when user-supplied sort field names are used in ORDER BY clauses without proper validation or identifier escaping. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24890 · Other software · openemr · reported by GitHubHigh 8.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to upload and overwrite provider signatures by setting `type=admin-signature` and specifying any provider user ID. This could potentially lead to signature forgery on medical documents, legal compliance violations, and fraud. The issue occurs when portal users are allowed to modify provider signatures without proper authorization checks. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24487 · Other software · openemr · reported by GitHubMedium 5.7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of being restricted to only the authenticated patient's data. This could potentially lead to unauthorized disclosure of Protected Health Information (PHI), including patient-provider relationships and care team structures across the entire system. The issue occurs because the `FhirCareTeamService` does not implement the `IPatientCompartmentResourceService` interface and does not pass the patient binding parameter to the underlying service, bypassing the patient compartment filtering mechanism. Version 8.0.0 contains a patch for this issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-23627 · Other software · openemr · reported by GitHubHigh 7.4
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI exfiltration, credential theft, and potential remote code execution. The vulnerability exists because user-supplied `patient_id` values are directly concatenated into SQL WHERE clauses without parameterization or escaping. Version 8.0.0 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25135 · Other software · openemr · reported by GitHubMedium 4.5
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure vulnerability that leaks the entire contact information for all users, organizations, and patients in the system to anyone who has the system/(Group,Patient,*).$export operation and system/Location.read capabilities. This vulnerability will impact OpenEMR versions since 2023. This disclosure will only occur in extremely high trust environments as it requires using a confidential client with secure key exchange that requires an administrator to enable and grant permission before the app can even be used. This will typically only occur in server-server communication across trusted clients that already have established legal agreements. Version 8.0.0 contains a patch. As a workaround, disable clients that have the vulnerable scopes and only allow clients that do not have the system/Location.read scope until a fix has been deployed.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25131 · Other software · openemr · reported by GitHubHigh 8.8
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege users (such as Receptionist) to add and modify procedure types without proper authorization. This vulnerability is present in the /openemr/interface/orders/types_edit.php endpoint. Version 8.0.0 contains a patch.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25127 · Other software · openemr · reported by GitHubHigh 7
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly validate user permission. Unauthorized users can view the information of authorized users. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-25124 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vulnerable to an access control flaw that allows low-privileged users, such as receptionists, to export the entire message list containing sensitive patient and user data. The vulnerability lies in the message_list.php report export functionality, where there is no permission check before executing sensitive database queries. The only control in place is CSRF token verification, which does not prevent unauthorized data access if the token is acquired through other means. Version 8.0.0 fixes the vulnerability.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24896 · Other software · openemr · reported by GitHubMedium 6.5
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in OpenEMR’s edih_main.php endpoint, which allows any authenticated user—including low-privilege roles like Receptionist—to access EDI log files by manipulating the log_select parameter in a GET request. The back-end fails to enforce role-based access control (RBAC), allowing sensitive system logs to be accessed outside the GUI-enforced permission boundaries. Version 8.0.0 fixes the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026OpenEMR is a free and open source electronic health records and medical practice management application.CVE-2026-24849 · Other software · openemr · reported by GitHubCritical 9.9
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from the server filesystem. Any authenticated user (regardless of privilege level) can exploit this vulnerability to read sensitive files. Version 7.0.4 patches the issue.
- Product
- openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.