OP
Product
openemr
103
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 7High 31Medium 59Low 0
Watch
Add openemr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25743 | 4.8 | Feb 25 | OpenEMR has Stored XSS in Questionnaire answers Affected: < 8.0.0 |
| CVE-2024-0875 | 4.8 | Nov 15 | Stored XSS in openemr/openemr Affected: before 7.0.2.1 |
| CVE-2025-30149 | 4.6 | Mar 31 | OpenEMR Reflected XSS in AJAX Script Affected: < 7.0.3 |
| CVE-2026-25135 | 4.5 | Feb 25 | OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information Affected: < 8.0.0 |
| CVE-2026-32119 | 4.4 | Mar 19 | OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page Affected: < 8.0.0.2 |
| CVE-2026-76614 | 4.3 | Aug 19 | OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore Affected: before 8.3.0 |
| CVE-2026-40509 | 4.3 | Aug 19 | OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter Affected: before 8.3.0 |
| CVE-2026-33934 | 4.3 | Mar 25 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures Affected: < 8.0.0.3 |
| CVE-2026-32122 | 4.3 | Mar 11 | OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) Affected: < 8.0.0.1 |