CVE Tools
Track your stack

Orthanc

9 CVEs tracked since 2026. Since Apr 2026, none of them reached CISA KEV.

Orthanc CVEs per month

Apr 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Orthanc CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0490
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Orthanc's monthly top three, with their CVEs summed over those months.

  1. Dicom Server91 month

Latest CVEs

The 14 most recently published vulnerabilities affecting Orthanc.

  1. CVE-2026-87020Orthanc DICOM Server Integer Overflow or Wraparound8.1
  2. CVE-2026-10528Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow3.3
  3. CVE-2026-10173Orthanc Explorer 2 URL StudyList.vue cross site scripting4.3
  4. CVE-2026-5439Memory Exhaustion via Forged ZIP Metadata7.5
  5. CVE-2026-5437Out-of-Bounds Read in DicomStreamReader7.5
  6. CVE-2026-5438Gzip Decompression Bomb via Content-Encoding Header7.5
  7. CVE-2026-5440Memory Exhaustion via Unbounded Content-Length7.5
  8. CVE-2026-5442Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions9.8
  9. CVE-2026-5443Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)9.8
  10. CVE-2026-5445Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)9.1
  11. CVE-2026-5444Heap Buffer Overflow in PAM Image Buffer Allocation7.1
  12. CVE-2026-5441Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)7.1
  13. CVE-2025-0896Orthanc Server Missing Authentication for Critical Function9.8
  14. CVE-2023-7238Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer7.1

The record

Peak rank
#128 in Apr 2026
Busiest month shown
Apr 2026, 9 CVEs
Months with a KEV entry
0 since Apr 2026
Monthly snapshots
1 since 2026
Orthanc's full record, month by month