CVE-2026-24487

OpenEMR before 8.0.0 contains an authorization bypass in the FHIR CareTeam resource endpoint. The root cause is that FhirCareTeamService does not implement IPatientCompartmentResourceService and does not pass the patient binding parameter to the underlying service, bypassing patient compartment f...

EUVD-2026-8701

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of bein...

CVE-2026-24487 OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of bein...

CVE-2026-25135

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure vulnerability that leaks the entire contact information for all users, organizations, and patients in the system to anyone who has the...

OpenEMR security vulnerabilities

OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0 contained security...

VulnCheck KEV: CVE-2025-0683

In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a...

CVE-2020-12037

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption e.g., TLS/SSL when configured to send treatment data to a PDMS Patient Data Management System or an EMR Electronic Medical Record system. An attacker could observe...

Health check-up Platform Unauthorized Access

The vulnerability of the “Health check-up” patient physiological monitoring platform involves the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

EUVD-2017-3303

Malware in sbrugna...

EUVD-2018-10682

Malware in sbrugna...

EUVD-2021-18960

Malware in sbrugna...

EUVD-2020-4352

Malware in sbrugna...

EUVD-2020-8184

Malware in sbrugna...

EUVD-2018-7032

Malware in sbrugna...

EUVD-2025-1815

Malicious code in bioql PyPI...

EUVD-2024-27230

Malicious code in bioql PyPI...

Lightweight Electronic Signatures and Reliable Access Control Included in Sensor Networks to Prevent Cyber Attacks from Modifying Patient Data

Digital terrorism is a major cause of securing patient/healthcare providers data and information. Sensitive topics that may have an impact on a patient's health or even national security include patient health records and information on healthcare providers. Health databases and data sets have be...

CVE-2024-1228

Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations. This issue affects Eurosoft Przychodnia software before version 20240417.001 from that version...

CVE-2022-47376

The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data...

CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...