Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,138All CVEsplus 19,141 rejected
- 206Last 24 hours3,295 in the last 7 days
- 16,932Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 12 | 86 | 46 | 1 | 0 | 145 | 192 |
| 2025 | 0 | 5 | 4 | 0 | 0 | 9 | 47 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 38 |
| 2023 | 0 | 5 | 6 | 0 | 0 | 11 | 37 |
| 2022 | 2 | 15 | 9 | 0 | 0 | 26 | 26 |
| Title | ||
|---|---|---|
| CVE-2026-124490 | OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocumentopenemr · openemr | Critical9.4 |
| CVE-2026-124489 | OpenEMR before 8.3.0 Broken Access Control via portal_payment.phpopenemr · openemr | High7.1 |
| CVE-2026-124488 | OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encountersopenemr · openemr | High8.6 |
| CVE-2026-124487 | OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docrefopenemr · openemr | High7.1 |
| CVE-2026-124486 | OpenEMR before 8.3.0 Missing Authorization in Classic Document Controlleropenemr · openemr | High8.7 |
| CVE-2026-124485 | OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents APIopenemr · openemr | High7.1 |
| CVE-2026-124484 | OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIsopenemr · openemr | High8.7 |
| CVE-2026-124483 | OpenEMR before 8.4.0 Improper Authorization via Prescription REST APIopenemr · openemr | High8.7 |
| CVE-2026-124482 | OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launchopenemr · openemr | High7.1 |
| CVE-2026-124481 | OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Paymentsopenemr · openemr | High7.1 |
| CVE-2026-124480 | OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKENopenemr · openemr | High8.7 |
| CVE-2026-124479 | OpenEMR before 8.4.0 Arbitrary File Read via REST Document Downloadopenemr · openemr | High7.1 |
| CVE-2026-124478 | OpenEMR before 8.3.0 Missing Authorization via addRecall in save.phpopenemr · openemr | High7.1 |
| CVE-2026-124477 | OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.phpopenemr · openemr | High8.7 |
| CVE-2026-124476 | OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.phpopenemr · openemr | High7.1 |
| CVE-2026-124475 | OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patientopenemr · openemr | High7.1 |
| CVE-2026-124473 | OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update APIopenemr · openemr | High7.1 |
| CVE-2026-124472 | OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.phpopenemr · openemr | High8.6 |
| CVE-2026-124471 | OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.phpopenemr · openemr | High8.6 |
| CVE-2026-124470 | OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Listsopenemr · openemr | High7.1 |
| CVE-2026-124469 | OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameteropenemr · openemr | Critical9.4 |
| CVE-2026-124468 | OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST APIopenemr · openemr | High7.1 |
| CVE-2026-124467 | OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax uploadopenemr · openemr | High8.7 |
| CVE-2026-124466 | OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uriopenemr · openemr | Medium6.9 |
| CVE-2026-124464 | OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponseopenemr · openemr | High7.1 |
| CVE-2026-124463 | OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print Viewopenemr · openemr | Critical9.3 |
| CVE-2026-124462 | OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameteropenemr · openemr | High7.1 |
| CVE-2026-124461 | OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpointopenemr · openemr | High8.6 |
| CVE-2026-124460 | OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientControlleropenemr · openemr | High7.1 |
| CVE-2026-124459 | OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlersopenemr · openemr | High8.6 |
| CVE-2026-124458 | OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpointopenemr · openemr | High7.1 |
| CVE-2026-124457 | OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eranameopenemr · openemr | High7.2 |
| CVE-2026-124456 | OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Moduleopenemr · openemr | High7.1 |
| CVE-2026-124455 | OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignmentopenemr · openemr | High7.1 |
| CVE-2026-124453 | OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.phpopenemr · openemr | High7.1 |
| CVE-2026-124452 | OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notesopenemr · openemr | Medium5.1 |
| CVE-2026-124451 | OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIRopenemr · openemr | Medium6.0 |
| CVE-2026-124450 | OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocumentopenemr · openemr | Critical9.3 |
| CVE-2026-124449 | OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routesopenemr · openemr | High7.1 |
| CVE-2026-124448 | OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributesopenemr · openemr | High8.6 |
| CVE-2026-124447 | OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpointopenemr · openemr | High8.6 |
| CVE-2026-124446 | OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocumentopenemr · openemr | High8.7 |
| CVE-2026-124445 | OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Forceopenemr · openemr | Critical9.3 |
| CVE-2026-124444 | OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query APIopenemr · openemr | High7.1 |
| CVE-2026-102940 | OpenEMR: Missing Write ACL Allows Unauthorized Document ReassignmentPublic exploitopenemr · openemr | Critical9.6 |
| CVE-2026-103021 | OpenEMR: Username Enumeration via Pre-Authentication User Settings Loadingopenemr · openemr | Medium5.3 |
| CVE-2026-103020 | OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versionsopenemr · openemr | Medium5.3 |
| CVE-2026-103019 | OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpointopenemr · openemr | Medium4.3 |
| CVE-2026-104134 | OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)openemr · openemr | Medium6.5 |
| CVE-2026-103939 | OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryPublic exploitopenemr · openemr | Medium5.4 |