Technology · OpenEMR
OpenEMR vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 57 vulnerabilities in OpenEMR: 42 in the last 7 days and 57 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124490, was published on 8 November 2026. 57 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0.
- Last 7 days
- 42
- Last 90 days
- 57
- Critical, all time
- 5
- Exploited in the wild
- 0
About OpenEMR
Open source electronic health record management system.
Latest OpenEMR vulnerabilities
- CVE-2026-124490: OpenEMR path traversal in oe-module-faxsms disposeDocumentcriticalCVSS 9.1
- CVE-2026-124489: OpenEMR broken access control in portal payment processinghighCVSS 7.1
- CVE-2026-124488: OpenEMR authorization bypass in encounter form loadershighCVSS 8.1
- CVE-2026-124487: OpenEMR improper authorization in FHIR DocumentReference $docrefmediumCVSS 6.5
- CVE-2026-124486: OpenEMR missing authorization in classic document controllerhighCVSS 8.8
- CVE-2026-124485: OpenEMR authorization bypass in patient portal onsitedocuments APImediumCVSS 6.5
- CVE-2026-124484: OpenEMR missing authorization in portal onsite-document APIshighCVSS 8.8
- CVE-2026-124483: OpenEMR prescription REST API authorization bypasshighCVSS 8.3
- CVE-2026-124482: OpenEMR authorization bypass in SMART patient-launchmediumCVSS 6.5
- CVE-2026-124481: OpenEMR improper authorization in Rainforest patient portal paymentsmediumCVSS 6.5
- CVE-2026-124480: OpenEMR authorization bypass in FHIR QuestionnaireResponsehighCVSS 8.8
- CVE-2026-124478: OpenEMR missing authorization in addRecallmediumCVSS 6.5
- CVE-2026-124477: OpenEMR missing authorization in patient recall deletionhighCVSS 8.8
- CVE-2026-124476: OpenEMR insecure direct object reference in payment portalmediumCVSS 6.5
- CVE-2026-124475: OpenEMR insecure direct object reference in patient portal settingshighCVSS 7.1
- CVE-2026-124473: OpenEMR broken object-level authorization in SOAP note update APIhighCVSS 7.1
- CVE-2026-124472: OpenEMR missing authorization in billing note interfacehighCVSS 8.1
- CVE-2026-124471: OpenEMR authorization bypass in billing interfacehighCVSS 8.1
- CVE-2026-124470: OpenEMR broken object level authorization in patient portal reportmediumCVSS 6.5
- CVE-2026-124469: OpenEMR SQL injection in Fee Sheet drug-inventory lookupcriticalCVSS 9.9
- CVE-2026-124468: OpenEMR SQL injection in Standard REST API patient searchhighCVSS 7.1
- CVE-2026-124467: OpenEMR local file inclusion and arbitrary code execution via ESign and fax moduleshighCVSS 8.8
- CVE-2026-124466: OpenEMR server-side request forgery in OAuth2 jwks_urihighCVSS 7.2
- CVE-2026-124464: OpenEMR FHIR Patient Compartment bypass in QuestionnaireResponsemediumCVSS 6.5
- CVE-2026-124463: OpenEMR stored cross-site scripting in CAMOS Rx printhighCVSS 8.7
Most severe OpenEMR vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-124469: OpenEMR SQL injection in Fee Sheet drug-inventory lookupcriticalCVSS 9.9
- CVE-2026-124450: OpenEMR fax/sms module broken access control and path traversalcriticalCVSS 9.9
- CVE-2026-124445: OpenEMR OneTimeAuth token replay and PIN brute forcecriticalCVSS 9.8
- CVE-2026-102940: OpenEMR authorization bypass in document reassignmentcriticalCVSS 9.6
- CVE-2026-124490: OpenEMR path traversal in oe-module-faxsms disposeDocumentcriticalCVSS 9.1
- CVE-2026-124486: OpenEMR missing authorization in classic document controllerhighCVSS 8.8
- CVE-2026-124484: OpenEMR missing authorization in portal onsite-document APIshighCVSS 8.8
- CVE-2026-124480: OpenEMR authorization bypass in FHIR QuestionnaireResponsehighCVSS 8.8
- CVE-2026-124477: OpenEMR missing authorization in patient recall deletionhighCVSS 8.8
- CVE-2026-124467: OpenEMR local file inclusion and arbitrary code execution via ESign and fax moduleshighCVSS 8.8
Vulnerabilities per week
57 vulnerabilities in the last four weeks, up from none in the four before. 5 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 56 | 5 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many OpenEMR vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/openemr-openemr)<a href="https://junglewise.ai/threats/technologies/openemr-openemr"><img src="https://junglewise.ai/threats/technologies/openemr-openemr/badge.svg" alt="OpenEMR vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/openemr-openemr.json, and this page as text at https://junglewise.ai/threats/technologies/openemr-openemr.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "OpenEMR vulnerabilities", https://junglewise.ai/threats/technologies/openemr-openemr, 13 November 2026.