CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 09:23 UTC )
This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,437 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product openemr:openemr . Show all products
138 CVEs, showing 101 to 138 Previous Page 3 of 3 CVE Severity Title Published CVE-2023-2945 Healthcare
Medium 4.3 Missing Authorization in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2944 Healthcare
Medium 6.3 Improper Access Control in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2943 Healthcare
Medium 4.6 Code Injection in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2942 Healthcare
High 8.1 Improper Input Validation in openemr/openemr Assigned by @huntrdev
May 27, 2023 CVE-2023-2674 Healthcare
High 8.8 Improper Access Control in openemr/openemr Assigned by @huntrdev
May 12, 2023 CVE-2023-2566 Healthcare
High 7.5 Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev
May 8, 2023 CVE-2022-4733 Healthcare
Medium 6.7 Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev
Dec 24, 2022 CVE-2022-4615 Healthcare
High 8.3 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Dec 19, 2022 CVE-2022-4567 Healthcare
High 8.1 Improper Access Control in openemr/openemr Assigned by @huntrdev
Dec 17, 2022 CVE-2022-4506 Healthcare
High 7.6 Unrestricted Upload of File with Dangerous Type in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4505 Healthcare
High 8.8 Authorization Bypass Through User-Controlled Key in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4504 Healthcare
High 7.1 Improper Input Validation in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4503 Healthcare
Medium 6.4 Cross-site Scripting (XSS) - Generic in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-4502 Healthcare
High 7.3 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Dec 15, 2022 CVE-2022-2824 Healthcare
High 8.8 Authorization Bypass Through User-Controlled Key in openemr/openemr Assigned by @huntrdev
Aug 15, 2022 CVE-2022-2734 Healthcare
Critical 10.0 Improper Restriction of Rendered UI Layers or Frames in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2732 Healthcare
High 8.3 Missing Authorization in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2733 Healthcare
Critical 9.6 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2731 Healthcare
Medium 5.4 Cross-site Scripting (XSS) - Reflected in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2729 Healthcare
Medium 5.4 Cross-site Scripting (XSS) - DOM in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2730 Healthcare
Medium 6.5 Authorization Bypass Through User-Controlled Key in openemr/openemr Assigned by @huntrdev
Aug 9, 2022 CVE-2022-2494 Healthcare
Medium 6.3 Cross-site Scripting (XSS) - Stored in openemr/openemr Assigned by @huntrdev
Jul 22, 2022 CVE-2022-2493 Healthcare
High 8.3 Data Access from Outside Expected Data Manager Component in openemr/openemr Assigned by @huntrdev
Jul 22, 2022 CVE-2022-1461 Healthcare
High 8.1 Non Privilege User can Enable or Disable Registered in openemr/openemr Assigned by @huntrdev
Apr 25, 2022 CVE-2022-1459 Healthcare
High 8.3 Non-Privilege User Can View Patient’s Disclosures in openemr/openemr Assigned by @huntrdev
Apr 25, 2022 CVE-2022-1458 Healthcare
High 7.3 Stored XSS Leads To Session Hijacking in openemr/openemr Assigned by @huntrdev
Apr 25, 2022 CVE-2020-13567 Healthcare
High 8.8 Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. Assigned by talos
Apr 18, 2022 CVE-2022-1179 Healthcare
Medium 4.6 Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr Assigned by @huntrdev
Mar 30, 2022 CVE-2022-1180 Healthcare
Medium 4.6 Reflected Cross Site Scripting in openemr/openemr Assigned by @huntrdev
Mar 30, 2022 CVE-2022-1181 Healthcare
High 8.0 Stored Cross Site Scripting in openemr/openemr Assigned by @huntrdev
Mar 30, 2022 CVE-2022-1177 Healthcare
Medium 6.5 Accounting User Can Download Patient Reports in openemr in openemr/openemr Assigned by @huntrdev
Mar 30, 2022 CVE-2022-1178 Healthcare
High 7.3 Stored Cross Site Scripting in openemr/openemr Assigned by @huntrdev
Mar 30, 2022 CVE-2012-0992 Healthcare
High 8.5 interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter. Assigned by mitre
Feb 7, 2012 CVE-2012-0991 Healthcare
Low 3.5 Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. Assigned by mitre
Feb 7, 2012 CVE-2007-0649 Healthcare
Medium 4.3 Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such… Assigned by mitre
Feb 1, 2007 CVE-2006-5811 Healthcare
Medium 6.8 PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[… Assigned by mitre
Nov 8, 2006 CVE-2006-5795 Healthcare
High 7.5 Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir paramet… Assigned by mitre
Nov 8, 2006 CVE-2006-2929 Healthcare
Medium 6.8 PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbit… Assigned by mitre
Jun 9, 2006
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
