openemr
Number 98 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: OpenEMR, openemr
Total vulnerabilities
193
Critical
14
High
99
Known Exploited
0
Exploit available
5
Network, no login needed
11.4%
Of 193 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 145 | 11 | 73 | 60 | 1 | 0 |
| 2025 | 9 | 0 | 5 | 4 | 0 | 0 |
| 2024 | 2 | 1 | 1 | 0 | 0 | 0 |
| 2023 | 11 | 0 | 5 | 6 | 0 | 0 |
| 2022 | 26 | 2 | 15 | 9 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| openemr | 155 | 90 |
| openemr/openemr | 37 | 22 |
| OpenEMR | 1 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 47 | 26 |
| Insecure Direct Object Reference | 35 | 13 |
| Missing Authorization | 27 | 16 |
| SQL Injection | 14 | 13 |
| Improper Access Control | 9 | 5 |
| Path Traversal | 8 | 4 |
| Information Disclosure | 7 | 3 |
| Incorrect Authorization | 5 | 4 |
| External Control of File Name or Path | 4 | 3 |
| Improper Authorization | 4 | 2 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-124490 | OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument | Critical | 0.4% | |
| CVE-2026-124489 | OpenEMR before 8.3.0 Broken Access Control via portal_payment.php | High | 0.2% | |
| CVE-2026-124488 | OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters | High | 0.2% | |
| CVE-2026-124487 | OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docref | Medium | 0.2% | |
| CVE-2026-124486 | OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller | High | 0.2% | |
| CVE-2026-124485 | OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API | Medium | 0.2% | |
| CVE-2026-124484 | OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs | High | 0.2% | |
| CVE-2026-124483 | OpenEMR before 8.4.0 Improper Authorization via Prescription REST API | High | 0.2% | |
| CVE-2026-124482 | OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch | Medium | 0.2% | |
| CVE-2026-124481 | OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments | Medium | 0.2% |