CVE-2026-124486

OpenEMR versions prior to 8.3.0 are affected by a missing authorization vulnerability within the classic document controller . This flaw allows low-privilege authenticated users to move documents into a patients|demo category by invoking move_action_process. Once moved, an attacker can retrieve t...

CVE-2026-124482

OpenEMR versions before 8.4.0 are susceptible to an authorization bypass (CWE-639) during a SMART standalone-launch. This vulnerability allows low-privileged users with only the patients|demo ACL to bind arbitrary patient UUIDs into the OAuth token context. By selecting a victim during the author...

CVE-2026-124480

OpenEMR versions before 8.4.0 are vulnerable to an authorization bypass allowing low-privileged authenticated users to access cross-patient FHIR QuestionnaireResponse data. The root cause involves an oversight where attackers can reuse the session-exposed api_csrf_token_js value to bypass FHIR sc...

CVE-2026-124468

OpenEMR versions before 8.3.0 are vulnerable to an SQL injection vulnerability within the Standard REST API's patient insurance and employer search functions. The root cause is the improper concatenation of query-string parameter names into SQL statements as column identifiers without sufficient ...

CVE-2026-124462

OpenEMR versions before 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the OnsiteDocumentController::Query() function. The root cause is a case-sensitive authorization guard; authenticated portal patients can bypass the lowercase pid check by providing a c...

CVE-2026-124460

OpenEMR versions before 8.3.0 are affected by an Insecure Direct Object Reference (IDOR) vulnerability in the PortalPatientController::Read() function. This flaw allows authenticated patients to access the pending demographic change requests of other patients by manipulating the patientId query s...

CVE-2026-124455

OpenEMR versions prior to 8.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the OnsiteDocumentController::Query() function. This flaw allows authenticated portal patients to access the documents of other patients by providing malicious request parameters—such...

CVE-2026-124445

OpenEMR versions 7.0.1 before 8.4.0 are vulnerable due to a flaw in src/Common/Auth/OneTimeAuth.php . The application fails to respect the enforce_onetime_use and max_access_count flags, fails to revoke consumed service_auth tokens, and lacks rate limiting or strict comparison for login_pin check...

OpenEMR < 8.0.0 - MedEx Callback Unauthenticated Token Disclosure

OpenEMR 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callbackkey. id: CVE-2026-24898 info:...

CVE-2026-115573 OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-115573 OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-104139 OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/setpt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and...

CVE-2026-104139

The OpenEMR electronic health records application is vulnerable to a missing authorization flaw prior to version 8.3.0 . The library/ajax/set_pt.php endpoint allows authenticated users to set an arbitrary patient identifier in their active session without an ACL check. Consequently, a low-privile...

Accessed, Never Disclosed: Silent Access to Protected Health Information by Medical Artificial Intelligence Agents

Medical artificial intelligence agents should retrieve patient identifiers only when a task requires them, the data-minimization principle behind the HIPAA minimum necessary standard for protected health information PHI. An agent can retrieve identifiers without revealing them. Such silent access...

CVE-2026-9973-exploit

CVE-2026-9973 Bug fix https://chromium-review.googlesource.com/c/v8/v8/+/7822799 wasmturboshaft Fix Phi handling in Load Elimination some more Multiple Phis can depend on each other, so we have to clear all their replacements up front. Fixed: 509268941 Change-Id:...

CVE-2026-85260

CVE-2026-85260 — camel-mllp: protected health information written to the log Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-mllp component's logPhi option defaulted to true, so a deployment that did nothing wrote HL7 payload content — patient data — to the...

CVE-2026-13610

CVE-2026-13610 KiviCare – Clinic & Patient Management System CWE-269 Improper Privilege Management | Unauthenticated registration with attacker-chosen staff role → patient PHI disclosure Overview Critical vulnerability in the KiviCare – Clinic & Patient Management System WordPress plugin versions...

VLLM: Phi-4 Multimodal Audio Encoder Materializes And Retains Full Attention Matrices: A Single Max-length Audio OOM-cra

Summary The Phi-4 multimodal audio encoder "phi4mmaudio.py" / "phi4mmutils.py" runs its conformer attention in eager mode by default: the official HF config of "microsoft/Phi-4-multimodal-instruct" does not set "useptscaleddotproductattention", so the default "False" applies "phi4mmaudio.py:166",...

Systematic Evaluation of Adversarial Jailbreaking Attacks and Defenses across Seven Large Language Models

Large language models LLMs deployed in safety-critical settings must resist adversarial inputs designed to elicit harmful outputs. We present a systematic empirical evaluation of five adversarial jailbreaking attack families---direct requests, roleplay-based jailbreaking, hypothetical framing,...

GHSA-8397-8QF6-F2GM vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

Summary The Phi-4 multimodal audio encoder phi4mmaudio.py / phi4mmutils.py runs its conformer attention in eager mode by default: the official HF config of microsoft/Phi-4-multimodal-instruct does not set useptscaleddotproductattention, so the default False applies phi4mmaudio.py:166, :876;...