Branches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-126322 | OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php | < 8.3.0 | 8.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126415 | OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module | < 8.5.0 | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126416 | OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php | < 8.5.0 | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126418 | OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php | < 8.5.0 | 6.9 | — | 2026-11-13 | |
| CVE-2026-126417 | OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php | < 8.5.0 | 6.0 | — | 2026-11-13 | |
| CVE-2026-126419 | OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission | < 8.5.0 | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126420 | OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation | < 8.5.0 | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126421 | OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count | < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126422 | OpenEMR before 8.5.0 Missing Authorization via lists_touch.php | < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126423 | OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression | < 8.5.0 | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126424 | OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions | < 8.5.0 | 4.6 | 0.3% | 2026-11-13 | |
| CVE-2026-126425 | OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers | < 8.5.0 | 4.6 | — | 2026-11-13 | |
| CVE-2026-126426 | OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration | ≥ 5.0.2 < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126427 | OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form | < 8.5.0 | 4.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126428 | OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services | < 8.5.0 | 7.7 | 0.7% | 2026-11-13 | |
| CVE-2026-126429 | OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126430 | OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names | < 8.5.0 | 8.6 | — | 2026-11-13 | |
| CVE-2026-126431 | OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper | < 8.5.0 | 7.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126432 | OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php | < 8.5.0 | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126434 | OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form | < 8.5.0 | 8.6 | — | 2026-11-13 | |
| CVE-2026-126433 | OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php | < 8.5.0 | 6.0 | — | 2026-11-13 | |
| CVE-2026-126435 | OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags | < 8.5.0 | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126437 | OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126436 | OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint | < 8.5.0 | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126438 | OpenEMR before 8.5.0 Improper Authorization in Clinical-Rule Editor patient_data.php | < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126440 | OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import | < 8.5.0 | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126439 | OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php | < 8.5.0 | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126441 | OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure | < 8.5.0 | 6.0 | — | 2026-11-13 | |
| CVE-2026-126443 | OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder | < 8.5.0 | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126442 | OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover | < 8.5.0 | 8.6 | — | 2026-11-13 | |
| CVE-2026-126444 | OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php | < 8.5.0 | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126446 | OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php | < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126445 | OpenEMR before 8.5.0 Missing Authorization in Patient Flow Board Tracker Endpoints | < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126447 | OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging | < 8.5.0 | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126448 | OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers | < 8.5.0 | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126449 | OpenEMR before 8.5.0 Missing Authorization in immunizations.php, diagnosis_full.php, billing_process.php | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126450 | OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions | < 8.5.0 | 5.3 | — | 2026-11-13 | |
| CVE-2026-126451 | OpenEMR before 8.5.0 Stored XSS via Document Template Rendering | < 8.5.0 | 8.5 | 0.4% | 2026-11-13 | |
| CVE-2026-126452 | OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations | < 8.5.0 | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126453 | OpenEMR before 8.5.0 Inverted Document Expiration Check Exposes PHI via FHIR Binary | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126454 | OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2 | < 8.5.0 | 8.6 | — | 2026-11-13 | |
| CVE-2026-126456 | OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field | < 8.5.0 | 5.1 | 0.2% | 2026-11-13 | |
| CVE-2026-126455 | OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection | < 8.5.0 | 8.6 | 0.3% | 2026-11-13 | |
| CVE-2026-126457 | OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126460 | OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing | < 8.5.0 | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126458 | OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php | < 8.5.0 | 8.7 | — | 2026-11-13 | |
| CVE-2026-126461 | OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override | < 8.5.0 | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126463 | OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126462 | OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders | < 8.5.0 | 5.1 | — | 2026-11-13 | |
| CVE-2026-126464 | OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation | < 8.5.0 | 5.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126465 | OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria | < 8.5.0 | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126466 | OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints | < 8.5.0 | 8.7 | — | 2026-11-13 | |
| CVE-2026-126467 | OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126468 | OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints | < 8.5.0 | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126469 | OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts | < 8.5.0 | 8.7 | 0.5% | 2026-11-13 | |
| CVE-2026-126470 | OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions | < 8.5.0 | 8.7 | — | 2026-11-13 | |
| CVE-2026-126472 | OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure | < 8.5.0 | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126471 | OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php | < 8.5.0 | 7.1 | — | 2026-11-13 | |
| CVE-2026-126473 | OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization | < 8.4.0 | 9.3 | 0.5% | 2026-11-13 | |
| CVE-2026-126474 | OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter | < 8.5.0 | 5.1 | — | 2026-11-13 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).