CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 6:10 AM ET)

What this means for you

This week: 3,087 CVEs published, 232 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,087; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product open-emr:openemr. Show all products

221 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2012-2115 Healthcare	High 7.5	SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter. Assigned by redhat	Sep 9, 2012
CVE-2011-5161 Healthcare	Medium 6.8	Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension foll… Assigned by mitre	Sep 9, 2012
CVE-2011-5160 Healthcare	Medium 4.3	Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter. Assigned by mitre	Sep 9, 2012
CVE-2013-4620 Healthcare	Medium 4.3	Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter. Assigned by mitre	Aug 9, 2013
CVE-2013-4619 Healthcare	Medium 6.5	Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_ra… Assigned by mitre	Aug 9, 2013
CVE-2014-5462 Healthcare	Medium 6.5	Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edi… Assigned by mitre	Dec 8, 2014
CVE-2015-4453 Healthcare	Medium 5.0	interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts,… Assigned by mitre	Jul 4, 2015
CVE-2017-6394 Healthcare	Medium 6.1	Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. Assigned by mitre	Mar 2, 2017
CVE-2017-9380 Healthcare	High 8.8	OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application. Assigned by mitre	Jun 2, 2017
CVE-2017-12064 Healthcare	High 7.5	The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name. Assigned by mitre	Aug 1, 2017

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.