CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 09:23 UTC )
This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,437 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product openemr:openemr . Show all products
CVE Severity Title Published CVE-2025-31121 Healthcare
High 7.0 OpenEMR allows XSS in Patient Image feature Assigned by GitHub_M
Apr 1, 2025 CVE-2025-32794 Healthcare
High 7.6 OpenEMR Stored XSS via Patient Name Field in Procedure Orders Assigned by GitHub_M
May 23, 2025 CVE-2025-32967 Healthcare
Medium 5.4 OpenEMR doesn't log password administration properly Assigned by GitHub_M
May 23, 2025 CVE-2025-43860 Healthcare
High 7.6 OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics Assigned by GitHub_M
May 23, 2025 CVE-2025-54373 Healthcare
High 7.1 OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege Assigned by GitHub_M
Jan 27, 2026 CVE-2025-67645 Healthcare
High 8.8 OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint Assigned by GitHub_M
Jan 27, 2026 CVE-2025-67491 Healthcare
High 8.5 OpenEMR has Stored XSS in ub04 helper Assigned by GitHub_M
Feb 25, 2026 CVE-2025-67752 Healthcare
High 8.1 OpenEMR Has Disabled SSL Certificate Verification in HTTP Client Assigned by GitHub_M
Feb 25, 2026 CVE-2025-68277 Healthcare
High 7.2 OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal Assigned by GitHub_M
Feb 25, 2026 CVE-2025-69231 Healthcare
High 8.7 OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation Assigned by GitHub_M
Feb 25, 2026 CVE-2026-21443 Healthcare
Low 1.2 OpenEMR allows inconsistent escaping of translation function output Assigned by GitHub_M
Feb 25, 2026 CVE-2026-24847 Healthcare
Medium 6.1 OpenEMR has Open Redirect in Eye Exam Form Assigned by GitHub_M
Feb 25, 2026 CVE-2026-24849 Healthcare
Critical 10.0 OpenEMR Arbitrary File Read Vulnerability Assigned by GitHub_M
Feb 25, 2026 CVE-2026-24896 Healthcare
Medium 6.5 OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25124 Healthcare
Medium 6.5 OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25127 Healthcare
High 7.0 OpenEMR has Broken Access Control on Care Coordination Module Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25131 Healthcare
High 8.8 OpenEMR has Broken Access Control in Procedures Configuration Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25135 Healthcare
Medium 4.5 OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information Assigned by GitHub_M
Feb 25, 2026 CVE-2026-23627 Healthcare
High 7.4 OpenEMR has SQL Injection in Immunization Search/Report Assigned by GitHub_M
Feb 25, 2026 CVE-2026-24487 Healthcare
Medium 5.7 OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource Assigned by GitHub_M
Feb 25, 2026 CVE-2026-24890 Healthcare
High 8.1 OpenEMR Portal Users Can Forge Provider Signatures Assigned by GitHub_M
Feb 25, 2026 CVE-2026-24908 Healthcare
Critical 10.0 OpenEMR has SQL Injection in Patient API Sort Parameter Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25164 Healthcare
High 8.1 OpenEMR's Document and Insurance REST Endpoints Skip ACL Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25220 Healthcare
Medium 5.7 OpenEMR Messages "Show All" Not Restricted to Admins Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25476 Healthcare
High 7.5 OpenEMR has Session Timeout Bypass via skip_timeout_reset Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25743 Healthcare
High 7.2 OpenEMR has Stored XSS in Questionnaire answers Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25746 Healthcare
High 8.8 OpenEMR has SQL Injection Vulnerability Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25927 Healthcare
High 7.1 OpenEMR Missing Authorization Checks in DICOM Viewer State API Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25929 Healthcare
Medium 6.5 OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval Assigned by GitHub_M
Feb 25, 2026 CVE-2026-25930 Healthcare
Medium 6.5 OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms Assigned by GitHub_M
Feb 25, 2026 CVE-2026-27943 Healthcare
Medium 6.5 OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership Assigned by GitHub_M
Feb 26, 2026 CVE-2026-24488 Healthcare
Medium 6.5 OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint Assigned by GitHub_M
Feb 27, 2026 CVE-2026-25147 Healthcare
High 7.1 OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid Assigned by GitHub_M
Feb 27, 2026 CVE-2026-24848 Healthcare
High 8.7 OpenEMR Arbitrary File Write leading to Remote Code Execution Assigned by GitHub_M
Mar 3, 2026 CVE-2026-25146 Healthcare
Critical 9.6 OpenEMR's payments gateway_api_key secret rendered into client JS code Assigned by GitHub_M
Mar 3, 2026 CVE-2026-24898 Healthcare
Critical 10.0 OpenEMR has an Unauthenticated MedEx Token Disclosure Assigned by GitHub_M
Mar 3, 2026 CVE-2026-32118 Healthcare
Medium 5.4 OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32121 Healthcare
High 7.7 OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32122 Healthcare
Medium 4.3 OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32123 Healthcare
High 7.7 OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32124 Healthcare
Medium 5.4 OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS) Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32125 Healthcare
Medium 5.4 OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32126 Healthcare
High 7.1 OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans Assigned by GitHub_M
Mar 11, 2026 CVE-2026-32127 Healthcare
High 8.8 SQL Injection Vulnerability in ajax graphs library (OpenEMR) Assigned by GitHub_M
Mar 11, 2026 CVE-2026-25745 Healthcare
Medium 6.5 OpenEMR's Message Update Ignores Patient id Assigned by GitHub_M
Mar 18, 2026 CVE-2026-25744 Healthcare
Medium 6.5 OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals Assigned by GitHub_M
Mar 19, 2026 CVE-2026-25928 Healthcare
Medium 6.5 OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders Assigned by GitHub_M
Mar 19, 2026 CVE-2026-32238 Healthcare
Critical 9.1 OpenEMR has Remote Code Execution in backup functionality Assigned by GitHub_M
Mar 19, 2026 CVE-2026-32119 Healthcare
Medium 4.4 OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33299 Healthcare
High 8.5 OpenEMR has Stored XSS in patient encounter Eye Exam form answers Assigned by GitHub_M
Mar 19, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
