Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,944All CVEsplus 19,118 rejected
- 380Last 24 hours2,815 in the last 7 days
- 16,801Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 7 | 50 | 43 | 1 | 0 | 101 | 148 |
| 2025 | 0 | 5 | 4 | 0 | 0 | 9 | 47 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 38 |
| 2023 | 0 | 5 | 6 | 0 | 0 | 11 | 37 |
| 2022 | 2 | 15 | 9 | 0 | 0 | 26 | 26 |
| Title | ||
|---|---|---|
| CVE-2026-102940 | OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignmentopenemr · openemr | Critical9.6 |
| CVE-2026-103021 | OpenEMR: Username Enumeration via Pre-Authentication User Settings Loadingopenemr · openemr | Medium5.3 |
| CVE-2026-103020 | OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versionsopenemr · openemr | Medium5.3 |
| CVE-2026-103019 | OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpointopenemr · openemr | Medium4.3 |
| CVE-2026-104134 | OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)openemr · openemr | Medium6.5 |
| CVE-2026-103939 | OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryopenemr · openemr | Medium5.4 |
| CVE-2026-104138 | OpenEMR: Missing authorization on QRDA Category I/III download endpointsopenemr · openemr | Medium6.5 |
| CVE-2026-115573 | OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumerationopenemr · openemr | High8.1 |
| CVE-2026-104133 | OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallopenemr · openemr | High7.1 |
| CVE-2026-103935 | OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attributeopenemr · openemr | High8.1 |
| CVE-2026-104135 | OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthopenemr · openemr | Medium6.5 |
| CVE-2026-104136 | OpenEMR: Arbitrary Patient Recall and Contact Detail Readopenemr · openemr | High7.1 |
| CVE-2026-103938 | OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operationsopenemr · openemr | High7.1 |
| CVE-2026-104137 | OpenEMR: Patient Data Search Without Sufficient ACLopenemr · openemr | High7.1 |
| CVE-2026-104139 | OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHIopenemr · openemr | Medium6.5 |
| CVE-2026-65983 | OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootopenemr · openemr | High7.5 |
| CVE-2026-49142 | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]openemr · openemr | High8.7 |
| CVE-2026-76614 | OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restoreopenemr · openemr | Medium5.3 |
| CVE-2026-40509 | OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameteropenemr · openemr | Medium5.3 |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handleropenemr · openemr | Medium5.1 |
| CVE-2026-40507 | OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portalopenemr · openemr | Medium5.1 |
| CVE-2026-40506 | OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.phpopenemr · openemr | High7.0 |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Managementopenemr · openemr | Medium4.8 |
| CVE-2026-67611 | OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configurationopenemr · openemr | High8.6 |
| CVE-2026-67610 | OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Accessopenemr · openemr | High8.6 |
| CVE-2026-39932 | OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injectionopenemr · openemr | Critical9.4 |
| CVE-2026-39931 | OpenEMR Authenticated SQL Injection via backup.php Import Featureopenemr · openemr | High8.6 |
| CVE-2026-46518 | OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicsopenemr · openemr | High7.7 |
| CVE-2026-34056 | OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Dataopenemr · openemr | High7.7 |
| CVE-2026-34055 | OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modificationopenemr · openemr | High8.1 |
| CVE-2026-34053 | OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handleropenemr · openemr | High7.1 |
| CVE-2026-34051 | OpenEMR has Improper ACL On Import/Export Popupopenemr · openemr | Medium5.4 |
| CVE-2026-33934 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signaturesopenemr · openemr | Medium4.3 |
| CVE-2026-33933 | Reflected XSS via Unescaped contextName Parameter in Custom Template Editoropenemr · openemr | Medium6.1 |
| CVE-2026-33932 | OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributesopenemr · openemr | High7.6 |
| CVE-2026-33931 | OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Accessopenemr · openemr | Medium6.5 |
| CVE-2026-33918 | OpenEMR Missing Authorization on Claim File Download Endpointopenemr · openemr | High7.6 |
| CVE-2026-33917 | OpenEMR has SQL Injection in CAMOS Formopenemr · openemr | High8.8 |
| CVE-2026-33915 | OpenEMR Missing ACL Checks on Insurance Company API Routesopenemr · openemr | Medium5.4 |
| CVE-2026-33914 | OpenEMR has SQL Injection in PostCalendar Category Deleteopenemr · openemr | High7.2 |
| CVE-2026-33913 | OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Filesopenemr · openemr | High7.7 |
| CVE-2026-33912 | OpenEMR has reflected XSS in ajax_download.php via reportID parameteropenemr · openemr | Medium5.4 |
| CVE-2026-33911 | OpenEMR vulnerable to reflected XSS in graphs.php via title parameteropenemr · openemr | Medium5.4 |
| CVE-2026-33910 | OpenEMR has a SQL Injection Vulnerability in patient selectionopenemr · openemr | High7.2 |
| CVE-2026-33909 | OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processingopenemr · openemr | Medium5.9 |
| CVE-2026-33348 | OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3openemr · openemr | High8.7 |
| CVE-2026-32120 | OpenEMR has IDOR in Fee Sheet Product Saveopenemr · openemr | Medium6.5 |
| CVE-2026-29187 | OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.phpopenemr · openemr | High8.1 |
| CVE-2026-33346 | OpenEMR has stored XSS in portal_payment.php via Unescaped table_argsopenemr · openemr | High8.7 |
| CVE-2026-33305 | OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructoropenemr · openemr | Medium5.4 |