hapifhir__org_hl7_fhir_core_CVE-2023-28465_5-6-1055

HAPI FHIR - HL7 FHIR Core Artifacts CI Status master --- !Build StatusBadge-BuildPipelineLink-AzureMasterPipeline This is the java core object handling code, with utilities including validator, for the FHIR specification. included in this repo: org.fhir.fhir.utilities: Shared code used by all the...

CVE-2026-85260

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

EUVD-2026-104196

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260

The Apache Camel MLLP component is vulnerable to Insertion of Sensitive Information into Log File (CWE-532). In affected versions (4.0.0 to before 4.18.5, and 4.19.0 to before 4.22.1), the logPhi option defaulted to true , causing protected health information (PHI) from HL7 clinical messages to b...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

PT-2026-117355

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-105667

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-105667

The J4Care dcm4che system contains a vulnerability where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application in the default configuration. This lack of authentication allows a remote sender to reassign studies and related workflow records from on...

EUVD-2026-102895

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

PT-2026-115620

Name of the Vulnerable Software and Affected Versions affected versions not specified Description In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. This allows a remote sender to reassign studies and related...

ROOT-APP-MAVEN-CVE-2026-55470 CVE-2026-55470 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-55470 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

org.hl7.fhir.publisher:org.hl7.fhir.publisher (1.2.3), org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (1.2.3) +1 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.65)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.65 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - org.hl7.fhir.publisher:org.hl7.fhir.publisher 1.2.3 -...

org.hl7.fhir.publisher:org.hl7.fhir.publisher (1.1.12), org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli (1.1.12) +1 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.2)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - org.hl7.fhir.publisher:org.hl7.fhir.publisher 1.1.12 -...

EUVD-2026-76761

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

CVE-2026-44715 OpenMRS has Broken Access Control in HL7 Configuration

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

CVE-2026-44715

OpenMRS , an open-source electronic medical record platform, is affected by a Broken Access Control vulnerability in its HL7 configuration. Prior to versions 1.23.0 and 2.10.0 , the administrative DWR method startHl7ArchiveMigration, which should be restricted to admin-level accounts, is accessib...

PT-2026-90502

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts. Versions...

An Emulation Anchored Digital Twin Testbed for Cyberattack and Defense Analysis in Hospital IT OT Environments

Modern hospitals increasingly rely on integrated Information Technology IT and Operational Technology OT infrastructures to support critical healthcare services. However, this convergence expands the cybersecurity attack surface and makes safe validation of defensive mechanisms difficult on live...