CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,295 CVEs published, 240 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,295
Show in the list
Critical, last 7 days
240
Show in the list
Healthcare-tagged, last 7 days
6
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product ci4-cms-erp:ci4ms. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

27 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-39394High 8.1CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
Assigned by GitHub_M
Apr 8, 2026
CVE-2026-39393High 8.1Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
Assigned by GitHub_M
Apr 8, 2026
CVE-2026-39392Medium 5.5CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization
Assigned by GitHub_M
Apr 8, 2026
CVE-2026-39391Medium 4.8CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
Assigned by GitHub_M
Apr 8, 2026
CVE-2026-39390Medium 5.5CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Assigned by GitHub_M
Apr 8, 2026
CVE-2026-39389Medium 6.7CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Assigned by GitHub_M
Apr 8, 2026
CVE-2026-35035High 7.2CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
Assigned by GitHub_M
Apr 6, 2026
CVE-2026-34989Critical 9.4CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Assigned by GitHub_M
Apr 6, 2026
CVE-2026-34572High 8.8CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Assigned by GitHub_M
Apr 1, 2026
CVE-2026-34571Critical 10.0CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
Assigned by GitHub_M
Apr 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .