| CVE | タイトル | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|
| CVE-2026-129267 | sergix44 XBackBone MediaController.php getRawById cross site scripting | 5.1 | — | 2026-11-15 | |
| CVE-2026-129430 | axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links | 5.1 | — | 2026-11-14 | |
| CVE-2026-129248 | Akaunting Invoice Item Validation helpers.php calculation_to_quantity numeric range comparison without minimum... | 5.3 | — | 2026-11-14 | |
| CVE-2026-71519 | PrestaShop Webservice API Broken Access Control via Customer Endpoint | 8.6 | 0.5% | 2026-11-14 | |
| CVE-2026-71531 | PrestaShop Webservice API Authorization Bypass via id_shop Parameter | 8.6 | 0.5% | 2026-11-14 | |
| CVE-2026-129173 | Stirling-Tools Stirling-PDF Participant Details Endpoint WorkflowParticipantController.java session timeout | 6.9 | 0.4% | 2026-11-14 | |
| CVE-2026-89037 | Dolibarr < 24.0.2 IDOR via Ticket Documents API | 7.1 | 0.4% | 2026-11-14 | |
| CVE-2026-68551 | Budget Board's OIDC login links to an existing local account by email alone, with no email_verified check, ena... | 8.3 | 0.3% | 2026-11-14 | |
| CVE-2026-67444 | Hubleys: Stored XSS via unrestricted background-image upload, served with an attacker-chosen Content-Type and... | 7.1 | 0.3% | 2026-11-14 | |
| CVE-2026-107398 | Indico: Local file disclosure through offline-copy path traversal | 7.1 | 0.4% | 2026-11-14 | |
| CVE-2026-129131 | Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints | 6.9 | 0.4% | 2026-11-14 | |
| CVE-2026-128970 | Missing membership acceptance check permits group share-right deletion by invitees in Psono Server | 5.4 | 0.5% | 2026-11-13 | |
| CVE-2024-58404 | Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint | 8.3 | — | 2026-11-13 | |
| CVE-2024-58405 | Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint | 8.8 | 0.3% | 2026-11-13 | |
| CVE-2025-71459 | Zipline through 4.3.2 Path Traversal via x-zipline-filename Header | 7.2 | 0.4% | 2026-11-13 | |
| CVE-2025-71461 | Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery | 6.9 | 0.2% | 2026-11-13 | |
| CVE-2025-71460 | Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction | 2.3 | 0.2% | 2026-11-13 | |
| CVE-2025-71462 | Zipline before 3.7.12 XSS via url parameter on login page | 5.1 | 0.2% | 2026-11-13 | |
| CVE-2026-126264 | SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile | 8.3 | — | 2026-11-13 | |
| CVE-2026-126265 | SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie | 9.1 | — | 2026-11-13 | |
| CVE-2026-126267 | NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126266 | SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126268 | NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust | 6.9 | — | 2026-11-13 | |
| CVE-2026-126269 | NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type | 9.3 | — | 2026-11-13 | |
| CVE-2026-126270 | NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint | 6.9 | 0.4% | 2026-11-13 | |
| CVE-2026-126271 | NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read | 8.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126273 | NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap | 9.2 | — | 2026-11-13 | |
| CVE-2026-126272 | NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints | 7.1 | — | 2026-11-13 | |
| CVE-2026-126274 | NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog | 9.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126276 | NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange | 8.2 | — | 2026-11-13 | |
| CVE-2026-126275 | NocoDB before 2026.09.0 IDOR in Row Comment Operations | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126277 | NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API | 8.7 | — | 2026-11-13 | |
| CVE-2026-126278 | NocoDB before 2026.08.1 Password Reset Token Race Condition | 8.7 | 0.3% | 2026-11-13 | |
| CVE-2026-126279 | NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip | 7.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126280 | NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation | 9.1 | — | 2026-11-13 | |
| CVE-2026-126281 | NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy | 7.1 | — | 2026-11-13 | |
| CVE-2026-126283 | NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens | 8.7 | 0.3% | 2026-11-13 | |
| CVE-2026-126282 | NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update | 8.6 | 0.2% | 2026-11-13 | |
| CVE-2026-126284 | NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch | 2.3 | — | 2026-11-13 | |
| CVE-2026-126285 | NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter | 8.3 | — | 2026-11-13 | |
| CVE-2026-126286 | NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue | 8.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126287 | NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition | 6.0 | 0.2% | 2026-11-13 | |
| CVE-2026-126289 | NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts | 5.1 | — | 2026-11-13 | |
| CVE-2026-126288 | NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint | 6.9 | — | 2026-11-13 | |
| CVE-2026-126290 | NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126292 | NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response | 5.3 | — | 2026-11-13 | |
| CVE-2026-126291 | NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query | 8.7 | 0.3% | 2026-11-13 | |
| CVE-2026-126293 | NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL | 7.1 | — | 2026-11-13 | |
| CVE-2026-126305 | EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments | 8.5 | — | 2026-11-13 | |
| CVE-2026-126306 | EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment | 8.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126308 | Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps | 8.7 | — | 2026-11-13 | |
| CVE-2026-126313 | Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records | 5.3 | — | 2026-11-13 | |
| CVE-2026-126314 | Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126315 | Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure | 9.3 | 0.5% | 2026-11-13 | |
| CVE-2026-126317 | Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint | 8.7 | — | 2026-11-13 | |
| CVE-2026-126316 | Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL | 2.1 | — | 2026-11-13 | |
| CVE-2026-126318 | REDAXO before 5.21.6 Authorization Bypass of Live Version Permission | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126322 | OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php | 8.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126369 | Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass | 5.1 | — | 2026-11-13 | |
| CVE-2026-126323 | Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions | 5.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126370 | Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save | 8.7 | — | 2026-11-13 | |
| CVE-2026-126372 | Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126371 | Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126373 | Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions | 5.3 | — | 2026-11-13 | |
| CVE-2026-126374 | Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys | 5.3 | — | 2026-11-13 | |
| CVE-2026-126375 | Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait | 7.2 | 0.4% | 2026-11-13 | |
| CVE-2026-126376 | Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126377 | Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie() | 9.2 | — | 2026-11-13 | |
| CVE-2026-126378 | Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass | 9.4 | — | 2026-11-13 | |
| CVE-2026-126379 | Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding | 8.3 | 0.4% | 2026-11-13 | |
| CVE-2026-126381 | n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key | 4.9 | — | 2026-11-13 | |
| CVE-2026-126380 | Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload | 9.4 | 0.5% | 2026-11-13 | |
| CVE-2026-126382 | n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset | 6.3 | — | 2026-11-13 | |
| CVE-2026-126384 | n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node | 7.7 | 0.5% | 2026-11-13 | |
| CVE-2026-126383 | n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126385 | n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback | 4.8 | — | 2026-11-13 | |
| CVE-2026-126386 | n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration | 5.1 | — | 2026-11-13 | |
| CVE-2026-126387 | n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool | 6.0 | 0.4% | 2026-11-13 | |
| CVE-2026-126388 | n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes | 6.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126390 | n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download | 6.3 | — | 2026-11-13 | |
| CVE-2026-126389 | n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat | 6.3 | — | 2026-11-13 | |
| CVE-2026-126391 | n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape | 7.7 | 0.5% | 2026-11-13 | |
| CVE-2026-126393 | SiYuan before 3.8.10 SSRF via Skill-Install Download Redirect and DNS Rebinding | 5.3 | — | 2026-11-13 | |
| CVE-2026-126400 | Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex | 6.3 | 0.1% | 2026-11-13 | |
| CVE-2026-126403 | Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint | 8.5 | 0.3% | 2026-11-13 | |
| CVE-2026-126404 | Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation | 7.6 | 0.3% | 2026-11-13 | |
| CVE-2026-126405 | Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push | 7.1 | — | 2026-11-13 | |
| CVE-2026-126411 | Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints | 5.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126412 | Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126413 | Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint | 5.3 | — | 2026-11-13 | |
| CVE-2026-126414 | Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints | 8.7 | — | 2026-11-13 | |
| CVE-2026-126415 | OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126416 | OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126417 | OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php | 6.0 | — | 2026-11-13 | |
| CVE-2026-126418 | OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php | 6.9 | — | 2026-11-13 | |
| CVE-2026-126419 | OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126421 | OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count | 5.3 | — | 2026-11-13 | |
| CVE-2026-126420 | OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126422 | OpenEMR before 8.5.0 Missing Authorization via lists_touch.php | 5.3 | — | 2026-11-13 | |
| CVE-2026-126424 | OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions | 4.6 | 0.3% | 2026-11-13 | |
| CVE-2026-126423 | OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126425 | OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers | 4.6 | — | 2026-11-13 | |
| CVE-2026-126426 | OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration | 5.3 | — | 2026-11-13 | |
| CVE-2026-126427 | OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form | 4.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126428 | OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services | 7.7 | 0.7% | 2026-11-13 | |
| CVE-2026-126430 | OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names | 8.6 | — | 2026-11-13 | |
| CVE-2026-126429 | OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer | 7.1 | — | 2026-11-13 | |
| CVE-2026-126431 | OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper | 7.6 | 0.4% | 2026-11-13 | |
| CVE-2026-126432 | OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126433 | OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php | 6.0 | — | 2026-11-13 | |
| CVE-2026-126434 | OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form | 8.6 | — | 2026-11-13 | |
| CVE-2026-126435 | OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126437 | OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php | 7.1 | — | 2026-11-13 | |
| CVE-2026-126436 | OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126438 | OpenEMR before 8.5.0 Improper Authorization in Clinical-Rule Editor patient_data.php | 5.3 | — | 2026-11-13 | |
| CVE-2026-126440 | OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126439 | OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126441 | OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure | 6.0 | — | 2026-11-13 | |
| CVE-2026-126442 | OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover | 8.6 | — | 2026-11-13 | |
| CVE-2026-126443 | OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126444 | OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126445 | OpenEMR before 8.5.0 Missing Authorization in Patient Flow Board Tracker Endpoints | 5.3 | — | 2026-11-13 | |
| CVE-2026-126446 | OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php | 5.3 | — | 2026-11-13 | |
| CVE-2026-126447 | OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging | 6.0 | 0.3% | 2026-11-13 | |
| CVE-2026-126449 | OpenEMR before 8.5.0 Missing Authorization in immunizations.php, diagnosis_full.php, billing_process.php | 7.1 | — | 2026-11-13 | |
| CVE-2026-126448 | OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers | 5.3 | 0.3% | 2026-11-13 | |
| CVE-2026-126450 | OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions | 5.3 | — | 2026-11-13 | |
| CVE-2026-126452 | OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126451 | OpenEMR before 8.5.0 Stored XSS via Document Template Rendering | 8.5 | 0.4% | 2026-11-13 | |
| CVE-2026-126453 | OpenEMR before 8.5.0 Inverted Document Expiration Check Exposes PHI via FHIR Binary | 7.1 | — | 2026-11-13 | |
| CVE-2026-126454 | OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth2 | 8.6 | — | 2026-11-13 | |
| CVE-2026-126456 | OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field | 5.1 | 0.2% | 2026-11-13 | |
| CVE-2026-126455 | OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection | 8.6 | 0.3% | 2026-11-13 | |
| CVE-2026-126457 | OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions | 7.1 | — | 2026-11-13 | |
| CVE-2026-126458 | OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php | 8.7 | — | 2026-11-13 | |
| CVE-2026-126460 | OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing | 7.1 | 0.3% | 2026-11-13 | |
| CVE-2026-126461 | OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126462 | OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders | 5.1 | — | 2026-11-13 | |
| CVE-2026-126463 | OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules | 7.1 | — | 2026-11-13 | |
| CVE-2026-126464 | OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation | 5.3 | 0.2% | 2026-11-13 | |
| CVE-2026-126466 | OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints | 8.7 | — | 2026-11-13 | |
| CVE-2026-126465 | OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria | 7.1 | 0.4% | 2026-11-13 | |
| CVE-2026-126467 | OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php | 7.1 | — | 2026-11-13 | |
| CVE-2026-126469 | OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts | 8.7 | 0.5% | 2026-11-13 | |
| CVE-2026-126468 | OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126470 | OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions | 8.7 | — | 2026-11-13 | |
| CVE-2026-126471 | OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php | 7.1 | — | 2026-11-13 | |
| CVE-2026-126472 | OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure | 8.7 | 0.4% | 2026-11-13 | |
| CVE-2026-126473 | OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization | 9.3 | 0.5% | 2026-11-13 | |
| CVE-2026-126475 | OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint | 5.1 | — | 2026-11-13 |
本製品は NVD API のデータを使用していますが、NVD による承認または認定を受けたものではありません。CVE® は The MITRE Corporation の登録商標です。CVE レコードは CVE Program の利用規約に基づいて使用しています。