OpenEMR vulnerabilities

CVEs per yearBy the year they were published

1. 202226
2. 202311
3. 20241
4. 20259
5. 2026101

Newest CVEs

• CVE-2026-102940

  OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

  openemr · openemr

  Critical9.6
• CVE-2026-103021

  OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

  openemr · openemr

  Medium5.3
• CVE-2026-103020

  OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions

  openemr · openemr

  Medium5.3
• CVE-2026-103019

  OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint

  openemr · openemr

  Medium4.3
• CVE-2026-104134

  OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)

  openemr · openemr

  Medium6.5
• CVE-2026-103939

  OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory

  openemr · openemr

  Medium5.4
• CVE-2026-104138

  OpenEMR: Missing authorization on QRDA Category I/III download endpoints

  openemr · openemr

  Medium6.5
• CVE-2026-115573

  OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration

  openemr · openemr

  High8.1
• CVE-2026-104133

  OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall

  openemr · openemr

  High7.1
• CVE-2026-103935

  OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute

  openemr · openemr

  High8.1