Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| openemr | CVE-2026-126448 OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and… |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126449 OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billing_process.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write… |
7,1 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126450 OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script… |
5,0 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126451 OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by… |
8,5 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126440 OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care… |
6,0 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126441 OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages,… |
5,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126442 OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over… |
8,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126443 OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of… |
7,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126444 OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy… |
6,0 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126433 OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET… |
5,9 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126434 OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical… |
8,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126435 OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read… |
5,3 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126436 OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can… |
8,7 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126437 OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth… |
6,5 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126438 OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result,… |
4,3 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126439 OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to… |
6,0 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126427 OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information,… |
4,3 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126428 OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row… |
7,7 | 0,66 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126429 OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files… |
6,5 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126430 OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password… |
8,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126431 OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to… |
7,6 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126432 OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to… |
6,0 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126421 OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and… |
4,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126422 OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record "None known" allergy,… |
4,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126423 OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making… |
5,3 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.