48
CVEs
5
Critical
19
High
0
KEV
32
PoC
10
Unpatched C/H
62.5%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
19
MEDIUM
24
LOW
0
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-24898 | Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available. | CRITICAL | 10.0 | 0.2% | 70 |
PoC
|
| CVE-2026-24848 | Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available. | CRITICAL | 9.9 | 0.2% | 70 |
PoC
No patch
|
| CVE-2026-24849 | Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the server, potentially exposing patient health data. PoC and patch available. | CRITICAL | 9.9 | 0.0% | 70 |
PoC
|
| CVE-2026-24908 | SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the medical records system. PoC and patch available. | CRITICAL | 9.9 | 0.0% | 70 |
PoC
|
| CVE-2026-25146 | Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available. | CRITICAL | 9.6 | 0.0% | 68 |
PoC
|
| CVE-2025-67645 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.0% | 64 |
PoC
|
| CVE-2026-25131 | OpenEMR versions prior to 8.0.0 contain a broken access control flaw in the order types management system that allows low-privilege users (such as receptionists) to create and modify procedure types without proper authorization. Public exploit code exists for this vulnerability, which has a CVSS score of 8.8 and could enable unauthorized users to manipulate critical medical procedure data. The vulnerability has been patched in version 8.0.0 and later. | HIGH | 8.8 | 0.0% | 64 |
PoC
|
| CVE-2026-23627 | SQL injection in OpenEMR's Immunization module prior to version 8.0.0 enables authenticated users to execute arbitrary database queries through unparameterized patient_id inputs. This allows attackers to exfiltrate protected health information, steal credentials, and potentially achieve remote code execution with complete database compromise. Public exploit code exists for this vulnerability; organizations should upgrade to version 8.0.0 immediately. | HIGH | 8.8 | 0.0% | 64 |
PoC
|
| CVE-2026-25746 | SQL injection in OpenEMR versions before 8.0.0 allows authenticated users to execute arbitrary database queries through the prescription listing feature due to improper input validation. An attacker with valid credentials could exploit this to read, modify, or delete sensitive medical records and patient data. Public exploit code exists for this vulnerability; administrators should upgrade to version 8.0.0 immediately. | HIGH | 8.8 | 0.0% | 64 |
PoC
|
| CVE-2025-69231 | OpenEMR is a free and open source electronic health records and medical practice management application. [CVSS 8.7 HIGH] | HIGH | 8.7 | 0.2% | 64 |
PoC
|
| CVE-2023-54347 | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-25164 | OpenEMR versions prior to 8.0.0 fail to enforce API authorization checks on document and insurance endpoints, allowing any authenticated API client to read and modify all patient PHI regardless of assigned access controls. Public exploit code exists for this vulnerability, which affects healthcare organizations using OpenEMR's REST API. An attacker with valid API credentials can access sensitive medical records and insurance information across the entire patient database. | HIGH | 8.1 | 0.1% | 61 |
PoC
|
| CVE-2026-24890 | OpenEMR versions prior to 8.0.0 contain an authorization bypass in the patient portal that allows authenticated users to forge provider signatures by uploading files with admin-signature type parameters for any provider. Public exploit code exists for this vulnerability, which could enable signature forgery on medical documents, creating legal and compliance risks. Upgrade to version 8.0.0 or later to remediate this high-severity flaw. | HIGH | 8.1 | 0.1% | 61 |
PoC
|
| CVE-2025-67752 | OpenEMR is a free and open source electronic health records and medical practice management application. [CVSS 8.1 HIGH] | HIGH | 8.1 | 0.0% | 61 |
PoC
|
| CVE-2026-25476 | OpenEMR prior to version 8.0.0 fails to enforce session expiration when the skip_timeout_reset parameter is present in requests, allowing expired sessions to remain active indefinitely. An attacker with a stolen session cookie can exploit this by continuously sending the skip_timeout_reset parameter to maintain unauthorized access to sensitive health records without being logged out. Public exploit code exists for this vulnerability with a CVSS score of 7.5. | HIGH | 7.5 | 0.1% | 58 |
PoC
|