CVE-2026-67612 | Medium | 4.8 | 2026-08-03 | OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to in… |
CVE-2026-67611 | High | 8.1 | 2026-08-03 | OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by… |
CVE-2026-67610 | High | 8.1 | 2026-08-03 | OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attacker… |
CVE-2026-39932 | Critical | 9.1 | 2026-08-03 | OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authe… |
CVE-2026-39931 | High | 7.2 | 2026-08-03 | OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or… |
CVE-2026-46518 | High | 7.7 | 2026-06-10 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scriptin… |
CVE-2026-34056 | High | 7.7 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to… |
CVE-2026-34055 | High | 8.1 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the legacy patient notes fun… |
CVE-2026-34053 | High | 7.1 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the… |
CVE-2026-34051 | Medium | 5.4 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access cont… |
CVE-2026-33934 | Medium | 4.3 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization… |
CVE-2026-33933 | Medium | 6.1 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0… |
CVE-2026-33932 | High | 7.6 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scriptin… |
CVE-2026-33931 | Medium | 6.5 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Re… |
CVE-2026-33918 | High | 7.6 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download en… |
CVE-2026-33917 | High | 8.8 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vuln… |
CVE-2026-33915 | Medium | 5.4 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, five insurance company REST… |
CVE-2026-33914 | High | 7.2 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module cont… |
CVE-2026-33913 | High | 7.7 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with a… |
CVE-2026-33912 | Medium | 5.4 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker co… |
CVE-2026-33911 | Medium | 5.4 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the POST parameter `title` i… |
CVE-2026-33910 | High | 7.2 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL inj… |
CVE-2026-33909 | Medium | 5.9 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several variables in the Med… |
CVE-2026-33348 | High | 8.7 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Users with the `Notes - my encounters` role can fill E… |
CVE-2026-32120 | Medium | 6.5 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Re… |
CVE-2026-29187 | High | 8.1 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulner… |
CVE-2026-33346 | High | 8.7 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS)… |
CVE-2026-33321 | High | 7.6 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounter… |
CVE-2026-33305 | Medium | 5.4 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optio… |
CVE-2026-33304 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the dated… |
CVE-2026-33303 | Medium | 5.4 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulnerable to stored cro… |
CVE-2026-33302 | High | 8.1 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function `AclMain::zh… |
CVE-2026-33301 | High | 8.1 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounte… |
CVE-2026-33299 | Medium | 5.4 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounter… |
CVE-2026-32238 | Critical | 9.1 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection… |
CVE-2026-32119 | Medium | 4.4 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery S… |
CVE-2026-25928 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a… |
CVE-2026-25744 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an… |
CVE-2026-25745 | Medium | 6.5 | 2026-03-18 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/not… |
CVE-2026-32127 | High | 8.8 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vul… |
CVE-2026-32126 | High | 7.1 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in Con… |
CVE-2026-32125 | Medium | 5.4 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, track/item names from the Track Anyt… |
CVE-2026-32124 | Medium | 5.4 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code picker AJAX endpoin… |
CVE-2026-32123 | High | 7.7 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, sensitivity checks for group encount… |
CVE-2026-32122 | Medium | 4.3 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the Claim File Tracker feature expos… |
CVE-2026-32121 | High | 7.7 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML… |
CVE-2026-32118 | Medium | 5.4 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, stored cross-site scripting (XSS) in… |
CVE-2026-25146 | Critical | 9.6 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two p… |
CVE-2026-24898 | Critical | 10.0 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vu… |
CVE-2026-24848 | Critical | 9.9 | 2026-03-03 | OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in… |
CVE-2026-25147 | High | 7.1 | 2026-02-27 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in `portal/portal_payment.php`… |
CVE-2026-24488 | Medium | 6.5 | 2026-02-27 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, an arbitrary fi… |
CVE-2026-27943 | Medium | 6.5 | 2026-02-26 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam (e… |
CVE-2026-25930 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-Based Form (LBF) pr… |
CVE-2026-25929 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `pat… |
CVE-2026-25927 | High | 7.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e… |
CVE-2026-25746 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulner… |
CVE-2026-25743 | Medium | 4.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, users with the "Forms administ… |
CVE-2026-25476 | High | 7.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check i… |
CVE-2026-25220 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the… |
CVE-2026-25164 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `a… |
CVE-2026-24908 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-24890 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulner… |
CVE-2026-24487 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulner… |
CVE-2026-23627 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-25135 | Medium | 4.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure… |
CVE-2026-25131 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulner… |
CVE-2026-25127 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the server does not properly v… |
CVE-2026-25124 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vul… |
CVE-2026-24896 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulner… |
CVE-2026-24849 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method… |
CVE-2026-24847 | Medium | 6.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Eye Exam form module allow… |
CVE-2026-21443 | Medium | 6.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the `xl()` translation functio… |
CVE-2025-69231 | High | 8.7 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting… |
CVE-2025-68277 | Medium | 5.0 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure… |
CVE-2025-67752 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper… |
CVE-2025-67491 | Medium | 5.4 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-s… |
CVE-2025-67645 | High | 8.8 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control i… |
CVE-2025-54373 | Medium | 6.5 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sen… |
CVE-2025-43860 | High | 7.6 | 2025-05-23 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in v… |
CVE-2025-32967 | Medium | 5.4 | 2025-05-23 | OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions prior to 7.0.3.4 allow… |
CVE-2025-32794 | High | 7.6 | 2025-05-23 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in v… |
CVE-2025-31121 | Medium | 5.4 | 2025-04-01 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR… |
CVE-2025-31117 | High | 7.5 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF)… |
CVE-2025-30161 | Medium | 5.4 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form comp… |
CVE-2025-30149 | Medium | 6.4 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in… |
CVE-2025-29772 | Medium | 6.1 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the… |
CVE-2025-29789 | High | 7.5 | 2025-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Tr… |
CVE-2024-0875 | Medium | 4.8 | 2024-11-15 | A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field… |
CVE-2023-2950 | High | 8.1 | 2023-05-28 | Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2949 | Medium | 6.1 | 2023-05-28 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2948 | Medium | 6.1 | 2023-05-28 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2947 | Medium | 4.8 | 2023-05-27 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2946 | High | 8.1 | 2023-05-27 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2945 | Medium | 5.4 | 2023-05-27 | Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2944 | Medium | 5.4 | 2023-05-27 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2943 | High | 8.8 | 2023-05-27 | Code Injection in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2942 | High | 8.1 | 2023-05-27 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2674 | Medium | 4.3 | 2023-05-12 | Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2566 | Medium | 4.8 | 2023-05-08 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. |