CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 14:10 UTC )
This week: 5,511 CVEs published, 359 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,511 Show in the list Critical, last 7 days 359 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product open-emr:openemr . Show all products
CVE Severity Title Published CVE-2022-2729 Healthcare
Medium 5.4 Cross-site Scripting (XSS) - DOM in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2731 Healthcare
Medium 5.4 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2733 Healthcare
Critical 9.6 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2732 Healthcare
High 8.3 Missing Authorization in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2734 Healthcare
Critical 10.0 Improper Restriction of Rendered UI Layers or Frames in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2824 Healthcare
High 8.8 Authorization Bypass Through User-Controlled Key in openemr/openemr Assigned by @huntrdev
Aug 15, 2022 CVE-2022-4506 Healthcare
High 7.6 Unrestricted Upload of File with Dangerous Type in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4505 Healthcare
High 8.8 Authorization Bypass Through User-Controlled Key in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4504 Healthcare
High 7.1 Improper Input Validation in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4503 Healthcare
Medium 6.4 Cross-site Scripting (XSS) - Generic in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4502 Healthcare
High 7.3 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4567 Healthcare
High 8.1 Improper Access Control in openemr/openemr Assigned by @huntrdev
Dec 17, 2022 CVE-2022-4615 Healthcare
High 8.3 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Dec 19, 2022 CVE-2022-4733 Healthcare
Medium 6.7 Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev
Dec 24, 2022 CVE-2023-22974 Healthcare
High 7.5 A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server. Assigned by mitre
Feb 22, 2023 CVE-2023-22973 Healthcare
High 8.8 A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter. Assigned by mitre
Feb 22, 2023 CVE-2023-22972 Healthcare
Medium 5.4 A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML v… Assigned by mitre
Feb 22, 2023 CVE-2023-2566 Healthcare
High 7.5 Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev
May 8, 2023 CVE-2023-2674 Healthcare
High 8.8 Improper Access Control in openemr/openemr Assigned by @huntrdev
May 12, 2023 CVE-2023-2947 Healthcare
Medium 4.7 Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2946 Healthcare
Medium 6.3 Improper Access Control in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2945 Healthcare
Medium 4.3 Missing Authorization in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2944 Healthcare
Medium 6.3 Improper Access Control in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2943 Healthcare
Medium 4.6 Code Injection in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2942 Healthcare
High 8.1 Improper Input Validation in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2950 Healthcare
Medium 6.3 Improper Authorization in openemr/openemr Assigned by @huntrdev
May 28, 2023 CVE-2023-2949 Healthcare
High 8.3 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
May 28, 2023 CVE-2023-2948 Healthcare
High 8.3 Cross-site Scripting (XSS) - Generic in openemr/openemr Assigned by @huntrdev
May 28, 2023 CVE-2024-26476 Healthcare
Low 3.5 An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component. Assigned by mitre
Feb 28, 2024 CVE-2024-37734 Healthcare
Critical 9.8 An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter. Assigned by mitre
Jun 26, 2024 CVE-2024-0875 Healthcare
High 8.1 Stored XSS in openemr/openemr Assigned by @huntr_ai
Nov 15, 2024 CVE-2025-29789 Healthcare
Medium 4.6 OpenEMR Has Directory Traversal in Load Code feature Assigned by GitHub_M
Mar 25, 2025 CVE-2025-29772 Healthcare
High 7.2 OpenEMR allows Reflected XSS in CAMOS new.php Assigned by GitHub_M
Mar 31, 2025 CVE-2025-30149 Healthcare
Medium 6.4 OpenEMR Reflected XSS in AJAX Script Assigned by GitHub_M
Mar 31, 2025 CVE-2025-30161 Healthcare
High 8.4 OpenEMR Stored XSS in OpenEMR Bronchitis Form Assigned by GitHub_M
Mar 31, 2025 CVE-2025-31117 Healthcare
Medium 6.9 OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability Assigned by GitHub_M
Mar 31, 2025 CVE-2025-31121 Healthcare
High 7.0 OpenEMR allows XSS in Patient Image feature Assigned by GitHub_M
Apr 1, 2025 CVE-2024-22611 Healthcare
Critical 9.8 OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php. Assigned by mitre
Apr 3, 2025 CVE-2025-32794 Healthcare
High 7.6 OpenEMR Stored XSS via Patient Name Field in Procedure Orders Assigned by GitHub_M
May 23, 2025 CVE-2025-32967 Healthcare
Medium 5.4 OpenEMR doesn't log password administration properly Assigned by GitHub_M
May 23, 2025 CVE-2025-43860 Healthcare
High 7.6 OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics Assigned by GitHub_M
May 23, 2025 CVE-2013-10044 Healthcare
High 8.7 OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE Assigned by VulnCheck
Aug 1, 2025 CVE-2021-47817 Healthcare
Medium 5.4 OpenEMR 5.0.2.1 - Remote Code Execution Assigned by VulnCheck
Jan 21, 2026 CVE-2025-54373 Healthcare
High 7.1 OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege Assigned by GitHub_M
Jan 27, 2026 CVE-2025-67645 Healthcare
High 8.8 OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint Assigned by GitHub_M
Jan 27, 2026 CVE-2025-67491 Healthcare
High 8.5 OpenEMR has Stored XSS in ub04 helper Assigned by GitHub_M
Feb 25, 2026 CVE-2025-67752 Healthcare
High 8.1 OpenEMR Has Disabled SSL Certificate Verification in HTTP Client Assigned by GitHub_M
Feb 25, 2026 CVE-2025-68277 Healthcare
High 7.2 OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal Assigned by GitHub_M
Feb 25, 2026 CVE-2025-69231 Healthcare
High 8.7 OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation Assigned by GitHub_M
Feb 25, 2026 CVE-2026-21443 Healthcare
Low 1.2 OpenEMR allows inconsistent escaping of translation function output Assigned by GitHub_M
Feb 25, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
