OR
Vendor
orthanc-server
14
CVEs
0
On KEV
0
New 30D
Products
OR9.8
orthanc
orthanc-server
13 CVEs0 on KEV0 new
OW6.1
Osimis Web Viewer
Orthanc-server
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-5439 | OR Orthanc Orthanc-server | 7.5 | Apr 9 | Memory Exhaustion via Forged ZIP Metadata |
| CVE-2026-5437 | OR Orthanc Orthanc-server | 7.5 | Apr 9 | Out-of-Bounds Read in DicomStreamReader |
| CVE-2026-5438 | OR Orthanc Orthanc-server | 7.5 | Apr 9 | Gzip Decompression Bomb via Content-Encoding Header |
| CVE-2026-5440 | OR Orthanc Orthanc-server | 7.5 | Apr 9 | Memory Exhaustion via Unbounded Content-Length |
| CVE-2026-5442 | OR Orthanc Orthanc-server | 9.8 | Apr 9 | Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions |
| CVE-2026-5443 | OR Orthanc Orthanc-server | 9.8 | Apr 9 | Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode) |
| CVE-2026-5445 | OR Orthanc Orthanc-server | 9.1 | Apr 9 | Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable) |
| CVE-2026-5444 | OR Orthanc Orthanc-server | 7.1 | Apr 9 | Heap Buffer Overflow in PAM Image Buffer Allocation |
| CVE-2026-5441 | OR Orthanc Orthanc-server | 7.1 | Apr 9 | Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression) |
| CVE-2025-15581 | OR orthanc orthanc-server | 4.7 | Feb 18 | Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation |
| CVE-2025-0896 | OR Orthanc Orthanc-server | 9.8 | Feb 13 | Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled |
| CVE-2024-22725 | OR Orthanc Orthanc-server | 6.1 | Jan 24 | Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability |
| CVE-2023-7238 | OW Osimis Web Viewer Orthanc-server | 6.1 | Jan 23 | A XSS payload can be uploaded as a DICOM study and when a user tries to view the infected study inside the Osimis WebViewer the XSS vulnerability gets triggered |
| CVE-2023-33466 | OR Orthanc Orthanc-server | 8.8 | Jun 29 | Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the… |