Openemr

This hub aggregates every CVE we track for Openemr, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Openemr.

• CVE-2026-76614OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore4.3Aug 19, 2026
• CVE-2026-40509OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter4.3Aug 19, 2026
• CVE-2026-40508OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler5.4Aug 19, 2026
• CVE-2026-40507OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal6.1Aug 19, 2026
• CVE-2026-40506OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php6.5Aug 17, 2026
• CVE-2026-67612OpenEMR 8.2.0 Stored XSS via import_template.php Template Management4.8Aug 3, 2026
• CVE-2026-67611OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration8.1Aug 3, 2026
• CVE-2026-67610OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access8.1Aug 3, 2026
• CVE-2026-39932OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection9.1Aug 3, 2026
• CVE-2026-39931OpenEMR Authenticated SQL Injection via backup.php Import Feature7.2Aug 3, 2026
• CVE-2026-46518OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics7.7Jun 9, 2026
• CVE-2023-54347OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass7.5May 5, 2026
• CVE-2026-34056OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data7.7Mar 25, 2026
• CVE-2026-34055OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification8.1Mar 25, 2026
• CVE-2026-34053OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler7.1Mar 25, 2026