Login Request a demo
HF
Product
Hl7 Fhir Core
by Hapifhir · last CVE Jul 8, 2026
7
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 3High 3Medium 1Low 0
Severity
All severities7Critical3High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Hl7 Fhir Core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-34361
9.3
0%
Mar 31
HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Affected: before 6.9.4
CVE-2026-55471
9.1
1%
Jul 8
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Affected: before 6.9.10
CVE-2026-34359
9.1
0%
Mar 31
HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
Affected: before 6.9.4
CVE-2023-24057
8.1
1%
Jan 26
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a…
Affected: before 5.6.92
CVE-2026-55470
7.5
1%
Jul 8
HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Affected: before 6.9.10
CVE-2023-28465
7.5
1%
Dec 12
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory…
Affected: before 5.6.106
CVE-2026-34360
5.8
0%
Mar 31
HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Affected: before 6.9.4
Showing 7