🔍 Filter Threats
| Title | Severity | PoC | Actively Exploited | Source | Date |
|---|---|---|---|---|---|
| CVE-2026-124462 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124461 HIGH OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrit... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124460 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124459 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encou... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124458 HIGH OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124457 HIGH OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124456 HIGH OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124455 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124453 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124452 MEDIUM OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inj... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124451 MEDIUM OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in Beare... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124450 CRITICAL OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124449 HIGH OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. No... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124448 HIGH OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attr... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124447 HIGH OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request�... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124446 HIGH OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions th... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124445 CRITICAL OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, ne... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124444 HIGH OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise ... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124443 MEDIUM Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to ... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-124442 HIGH AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlF... | HIGH | ????? | ????? | NVD | 5 days ago |