openemr vulnerabilities and fixes
Exploited and high-severity openemr vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.1CVE-2026-115573OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI EnumerationVerify fixopenemr openemr
1 min read - 7.1CVE-2026-104133OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallVerify fixopenemr openemr
1 min read - 9.6CVE-2026-102940OpenEMR: Missing Write ACL Allows Unauthorized Document ReassignmentVerify fixopenemr openemr
1 min read - 8.1CVE-2026-103935OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML AttributeVerify fixopenemr openemr
1 min read - 7.1CVE-2026-104136OpenEMR: Arbitrary Patient Recall and Contact Detail ReadVerify fixopenemr openemr
1 min read - 7.1CVE-2026-103938OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen OperationsVerify fixopenemr openemr
1 min read - 7.1CVE-2026-104137OpenEMR: Patient Data Search Without Sufficient ACLVerify fixopenemr openemr
1 min read - 7.5CVE-2026-65983OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootVerify fixopenemr openemr
1 min read - 8.8CVE-2026-49142OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]Fix availableopenemr openemr
1 min read