CVE Tools
Track your stack

Orthanc-server

9 CVEs tracked since 2026. Since Apr 2026, none of them reached CISA KEV.

Orthanc-server CVEs per month

Apr 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Orthanc-server CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0490
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Orthanc-server's monthly top three, with their CVEs summed over those months.

  1. Orthanc91 month

Latest CVEs

The 14 most recently published vulnerabilities affecting Orthanc-server.

  1. CVE-2026-5439Memory Exhaustion via Forged ZIP Metadata7.5
  2. CVE-2026-5437Out-of-Bounds Read in DicomStreamReader7.5
  3. CVE-2026-5438Gzip Decompression Bomb via Content-Encoding Header7.5
  4. CVE-2026-5440Memory Exhaustion via Unbounded Content-Length7.5
  5. CVE-2026-5442Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions9.8
  6. CVE-2026-5443Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)9.8
  7. CVE-2026-5445Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)9.1
  8. CVE-2026-5444Heap Buffer Overflow in PAM Image Buffer Allocation7.1
  9. CVE-2026-5441Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression)7.1
  10. CVE-2025-15581Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escal...—
  11. CVE-2025-0896Orthanc Server Missing Authentication for Critical Function9.8
  12. CVE-2024-22725Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting.6.1
  13. CVE-2023-7238Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer7.1
  14. CVE-2023-33466Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment scenarios allows the attacker to overwrit...8.8

The record

Peak rank
#129 in Apr 2026
Busiest month shown
Apr 2026, 9 CVEs
Months with a KEV entry
0 since Apr 2026
Monthly snapshots
1 since 2026
Orthanc-server's full record, month by month