CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 11:40 PM ET)

What this means for you

This week: 3,365 CVEs published, 233 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,365; Show in the list
Critical, last 7 days: 233; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product openmrs:openmrs. Show all products

19 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2014-8073 Healthcare	Medium 6.8	Cross-site request forgery (CSRF) vulnerability in OpenMRS 2.1 Standalone Edition allows remote attackers to hijack the authentication of administrators for requests that add a new user via a Save Us… Assigned by mitre	Oct 23, 2014
CVE-2014-8072 Healthcare	Medium 4.0	The administration module in OpenMRS 2.1 Standalone Edition allows remote authenticated users to obtain read access via a direct request to /admin. Assigned by mitre	Oct 23, 2014
CVE-2014-8071 Healthcare	Medium 4.3	Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1… Assigned by mitre	Oct 23, 2014
CVE-2017-12796 Healthcare	Critical 9.8	The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema o… Assigned by mitre	Oct 23, 2017
CVE-2018-19276 Healthcare	Critical 10.0	OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in… Assigned by mitre	Mar 17, 2019
CVE-2020-5732 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. Assigned by tenable	Apr 17, 2020
CVE-2020-5733 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. Assigned by tenable	Apr 17, 2020
CVE-2020-5728 Healthcare	Medium 6.1	OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). Assigned by tenable	Apr 17, 2020
CVE-2020-5729 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Assigned by tenable	Apr 17, 2020
CVE-2020-5730 Healthcare	Medium 6.1	In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting. Assigned by tenable	Apr 17, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.