CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 10:20 UTC )
This week: 5,469 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,469 Show in the list Critical, last 7 days 357 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product openemr:openemr . Show all products
138 CVEs, showing 101 to 138 Previous Page 3 of 3 CVE Severity Title Published CVE-2026-33301 Healthcare
High 7.1 OpenEMR has arbitrary image file read via PDF generator Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33321 Healthcare
High 7.2 OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF) Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33302 Healthcare
High 7.3 OpenEMR: zhAclCheck Ignores Explicit ACL Denies Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33303 Healthcare
Medium 5.4 OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33304 Healthcare
Medium 6.5 OpenEMR has Authorization Bypass in Dated Reminders Log Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33305 Healthcare
Medium 5.4 OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor Assigned by GitHub_M
Mar 19, 2026 CVE-2026-33346 Healthcare
High 8.7 OpenEMR has stored XSS in portal_payment.php via Unescaped table_args Assigned by GitHub_M
Mar 19, 2026 CVE-2026-29187 Healthcare
High 8.1 OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php Assigned by GitHub_M
Mar 25, 2026 CVE-2026-32120 Healthcare
Medium 6.5 OpenEMR has IDOR in Fee Sheet Product Save Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33348 Healthcare
High 8.7 OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3 Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33909 Healthcare
Medium 5.9 OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33910 Healthcare
High 7.2 OpenEMR has a SQL Injection Vulnerability in patient selection Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33911 Healthcare
Medium 5.4 OpenEMR vulnerable to reflected XSS in graphs.php via title parameter Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33912 Healthcare
Medium 5.4 OpenEMR has reflected XSS in ajax_download.php via reportID parameter Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33913 Healthcare
High 7.7 OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33914 Healthcare
High 7.2 OpenEMR has SQL Injection in PostCalendar Category Delete Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33915 Healthcare
Medium 5.4 OpenEMR Missing ACL Checks on Insurance Company API Routes Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33917 Healthcare
High 8.8 OpenEMR has SQL Injection in CAMOS Form Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33918 Healthcare
High 7.6 OpenEMR Missing Authorization on Claim File Download Endpoint Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33931 Healthcare
Medium 6.5 OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33932 Healthcare
High 7.6 OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33933 Healthcare
Medium 6.1 Reflected XSS via Unescaped contextName Parameter in Custom Template Editor Assigned by GitHub_M
Mar 25, 2026 CVE-2026-33934 Healthcare
Medium 4.3 OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures Assigned by GitHub_M
Mar 25, 2026 CVE-2026-34051 Healthcare
Medium 5.4 OpenEMR has Improper ACL On Import/Export Popup Assigned by GitHub_M
Mar 25, 2026 CVE-2026-34053 Healthcare
High 7.1 OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler Assigned by GitHub_M
Mar 25, 2026 CVE-2026-34055 Healthcare
High 8.1 OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification Assigned by GitHub_M
Mar 25, 2026 CVE-2026-34056 Healthcare
High 7.7 OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data Assigned by GitHub_M
Mar 25, 2026 CVE-2026-46518 Healthcare
High 7.7 OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics Assigned by GitHub_M
Jun 9, 2026 CVE-2026-39931 Healthcare
High 7.2 OpenEMR Authenticated SQL Injection via backup.php Import Feature Assigned by VulnCheck
Aug 3, 2026 CVE-2026-39932 Healthcare
Critical 9.1 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection Assigned by VulnCheck
Aug 3, 2026 CVE-2026-67610 Healthcare
High 8.1 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access Assigned by VulnCheck
Aug 3, 2026 CVE-2026-67611 Healthcare
High 8.1 OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration Assigned by VulnCheck
Aug 3, 2026 CVE-2026-67612 Healthcare
Medium 4.8 OpenEMR 8.2.0 Stored XSS via import_template.php Template Management Assigned by VulnCheck
Aug 3, 2026 CVE-2026-40506 Healthcare
Medium 6.5 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php Assigned by VulnCheck
Aug 17, 2026 CVE-2026-40507 Healthcare
Medium 6.1 OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal Assigned by VulnCheck
Aug 19, 2026 CVE-2026-40508 Healthcare
Medium 5.4 OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler Assigned by VulnCheck
Aug 19, 2026 CVE-2026-40509 Healthcare
Medium 4.3 OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter Assigned by VulnCheck
Aug 19, 2026 CVE-2026-76614 Healthcare
Medium 4.3 OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore Assigned by VulnCheck
Aug 19, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
