Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 126–150 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-124466 | MEDIUM | Patched | 7.2 | 2026-11-08 | OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAut… |
| CVE-2026-124465 | HIGH | Patched | 6.5 | 2026-11-08 | Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics when a single record exceeds MessageGroupByteSi… |
| CVE-2026-124464 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQues… |
| CVE-2026-124463 | CRITICAL | Patched | 8.7 | 2026-11-08 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content… |
| CVE-2026-124462 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to bypass the… |
| CVE-2026-124461 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by sup… |
| CVE-2026-124460 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients… |
| CVE-2026-124459 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks.… |
| CVE-2026-124458 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read any staff member's dem… |
| CVE-2026-124457 | HIGH | Patched | 7.6 | 2026-11-08 | OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read files by supplying un… |
| CVE-2026-124456 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticat… |
| CVE-2026-124455 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other… |
| CVE-2026-124453 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for ot… |
| CVE-2026-124452 | MEDIUM | Patched | 5.4 | 2026-11-08 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inject scripts by adding … |
| CVE-2026-124451 | MEDIUM | Patched | 5.3 | 2026-11-08 | OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStr… |
| CVE-2026-124450 | CRITICAL | Patched | 9.9 | 2026-11-08 | OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. … |
| CVE-2026-124449 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens l… |
| CVE-2026-124448 | HIGH | Patched | 7.6 | 2026-11-08 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values ev… |
| CVE-2026-124447 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of t… |
| CVE-2026-124446 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low… |
| CVE-2026-124445 | CRITICAL | Patched | 9.8 | 2026-11-08 | OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed s… |
| CVE-2026-124444 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose… |
| CVE-2026-124443 | MEDIUM | Patched | 4.3 | 2026-11-08 | Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file … |
| CVE-2026-124442 | HIGH | Patched | 6.5 | 2026-11-08 | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard throu… |
| CVE-2026-124441 | HIGH | Patched | 8.8 | 2026-11-08 | Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generat… |