O
Vendor security profile
openemr
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical1
CISA KEV0
Public exploit10
Patch rate%45
Avg. CVSS7.0
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
10
0
0
CVE KEV
CVE severity distribution
11toplam CVE
Critical1 (9%)
High5 (45%)
Medium5 (45%)
Patch and exploitation view
%45
Verified patch
%0
CISA KEV
%91
Public exploit
5Patch available
0Partial
0Workaround
0Vendor: no patch
6Unknown
Latest vulnerabilities
5.3
CVE-2026-76614
OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore
O
Patch verifiedEPSS %0
5.3
CVE-2026-40509
OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
O
Patch verifiedEPSS %0
5.1
CVE-2026-40508
OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
O
Patch verifiedEPSS %0
5.1
CVE-2026-40507
OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
O
Patch verifiedEPSS %0
7.0
CVE-2026-40506
OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
O
Patch verifiedEPSS %1
4.8
CVE-2026-67612
OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
O
Patch status unknownEPSS %0
8.6
CVE-2026-67611
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
O
Patch status unknownEPSS %1
8.6
CVE-2026-67610
OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
O
Patch status unknownEPSS %0
9.4
CVE-2026-39932
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
O
Patch status unknownEPSS %2
8.6
CVE-2026-39931
OpenEMR Authenticated SQL Injection via backup.php Import Feature
O
Patch status unknownEPSS %1