🔍 Filter Threats
| Title | Severity | PoC | Actively Exploited | Source | Date |
|---|---|---|---|---|---|
| CVE-2026-124484 HIGH OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access c... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124483 HIGH OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124482 HIGH OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the O... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124481 HIGH OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, en... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124480 HIGH OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR Question... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124479 HIGH OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded docume... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124478 HIGH OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privi... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124477 HIGH OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124476 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124475 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124473 HIGH OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied S... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124472 HIGH OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124471 HIGH OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124470 HIGH OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated po... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124469 CRITICAL OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124468 HIGH OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124467 HIGH OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter int... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124466 MEDIUM OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests ... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124464 HIGH OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124463 CRITICAL OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving m... | CRITICAL | ????? | ????? | NVD | 5 days ago |