Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 101–125 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-124491 | MEDIUM | Patched | 6.4 | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML wi… |
| CVE-2026-124490 | CRITICAL | Patched | 9.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers… |
| CVE-2026-124489 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks … |
| CVE-2026-124488 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bo… |
| CVE-2026-124487 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to gene… |
| CVE-2026-124486 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other p… |
| CVE-2026-124485 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' doc… |
| CVE-2026-124484 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents… |
| CVE-2026-124483 | HIGH | Patched | 8.3 | 2026-11-08 | OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and reques… |
| CVE-2026-124482 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. At… |
| CVE-2026-124481 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount va… |
| CVE-2026-124480 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by … |
| CVE-2026-124479 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's … |
| CVE-2026-124478 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated us… |
| CVE-2026-124477 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete… |
| CVE-2026-124476 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere… |
| CVE-2026-124475 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients… |
| CVE-2026-124474 | MEDIUM | Patched | 6.1 | 2026-11-08 | MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the erro… |
| CVE-2026-124473 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belo… |
| CVE-2026-124472 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patie… |
| CVE-2026-124471 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing da… |
| CVE-2026-124470 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read … |
| CVE-2026-124469 | CRITICAL | Patched | 9.9 | 2026-11-08 | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] PO… |
| CVE-2026-124468 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names… |
| CVE-2026-124467 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<… |