CVE-2026-113875

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

EUVD-2026-108275

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (6.4.1) +29 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.6.97)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.6.97 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 6.4.1 - ca.uhn.hapi.fhir:hapi-fhir-cli-app 6.4.1 -...

ai.platon.gora:gora-core (1.0.0), ai.platon.gora:gora-mongodb (1.0.0) +1515 more potentially affected by CVE-2026-59739 via org.apache.zookeeper:zookeeper (>=3.9.0, <=3.9.5)

org.apache.zookeeper:zookeeper MAVEN version =3.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =0.1.0, =7.2.0, =7.2.0, =7.2.0, =9.9.0 and more Source cves: CVE-2026-59739 Source advisory: MEND:CVE-2026-59739...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +173 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=6.0.0, <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =8.10.0 and more Source cves: CVE-2026-49485 Source advisory: OSV:GHSA-7CMJ-V6X8-FRVV...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (5.1.0) +44 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 5.1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (6.4.1) +28 more potentially affected by CVE-2026-49485 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (5.6.97)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version 5.6.97 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4b and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 6.4.1 - ca.uhn.hapi.fhir:hapi-fhir-cli-app 6.4.1 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (5.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (5.1.0) +75 more potentially affected by CVE-2026-55471 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 5.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserv...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.1.3), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.1.3) +60 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.36)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 5.6.36 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.2, <=6.4.7), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.2, <=6.4.7) +58 more potentially affected by CVE-2026-55470 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.971)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.971 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.4.2, =6.4.2, =6.4.2, =6.4.2, =6.4.2,...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +2341 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (>=5.7.0, <=5.7.14)

org.springframework.security:spring-security-web MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +2341 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (>=5.7.0, <=5.7.14)

org.springframework.security:spring-security-web MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.6.0, <=8.10.0), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.6.0, <=7.4.5) +155 more potentially affected by CVE-2026-45367 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (>=6.0.0, <=6.9.4.1)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version =6.0.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.8.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =6.6.0, =8.4.0, =6.8.0, =6.6.0, =8.10.0 and more Source cves: CVE-2026-45367 Source advisory: OSV:GHSA-3653-68V6-RQ57...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +2735 more potentially affected by CVE-2026-22746 via org.springframework.security:spring-security-core (>=5.7.0, <=5.7.14)

org.springframework.security:spring-security-core MAVEN version =5.7.0, =5.3.1, =2.3.0, =6.10.0, =6.4.0, =8.2.2 - cc.chensoul.nacos:core-test 2.5.2 - cc.chensoul.nacos:nacos-address 2.5.2 - cc.chensoul.nacos:nacos-cmdb 2.5.2 - cc.chensoul.nacos:nacos-config 2.5.2 - cc.chensoul.nacos:nacos-console...

dev.dsf:dsf-fhir-server-jetty (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-tools-test-data-generator (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-fhir-server (>=1.0.0-m1, <=1.9.0)

dev.dsf:dsf-fhir-server MAVEN version =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: MEND:CVE-2026-40939...

dev.dsf:dsf-bpe-server-jetty (>=1.0.0-m1, <=1.9.0), dev.dsf:dsf-fhir-server-jetty (>=1.0.0-m1, <=1.9.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (>=1.0.0-m1, <=1.9.0)

dev.dsf:dsf-common-jetty MAVEN version =1.0.0-m1, =1.0.0-m1, =1.0.0-m1, =1.9.0 Source cves: CVE-2026-40939 Source advisory: MEND:CVE-2026-40939...

dev.dsf:dsf-bpe-server-jetty (1.0.0-m1), dev.dsf:dsf-fhir-server-jetty (1.0.0-m1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.0.0-m1)

dev.dsf:dsf-common-jetty MAVEN version 1.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.0.0-m1 - dev.dsf:dsf-fhir-server-jetty 1.0.0-m1 Source cves: CVE-2026-40939...

dev.dsf:dsf-bpe-server-jetty (1.3.0), dev.dsf:dsf-fhir-server-jetty (1.3.0) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.3.0)

dev.dsf:dsf-common-jetty MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.3.0 - dev.dsf:dsf-fhir-server-jetty 1.3.0 Source cves: CVE-2026-40939 Source...

dev.dsf:dsf-bpe-server-jetty (1.7.1), dev.dsf:dsf-fhir-server-jetty (1.7.1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.7.1)

dev.dsf:dsf-common-jetty MAVEN version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.7.1 - dev.dsf:dsf-fhir-server-jetty 1.7.1 Source cves: CVE-2026-40939 Source...

dev.dsf:dsf-bpe-server-jetty (1.5.1), dev.dsf:dsf-fhir-server-jetty (1.5.1) potentially affected by CVE-2026-40939 via dev.dsf:dsf-common-jetty (1.5.1)

dev.dsf:dsf-common-jetty MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on dev.dsf:dsf-common-jetty and may be impacted: - dev.dsf:dsf-bpe-server-jetty 1.5.1 - dev.dsf:dsf-fhir-server-jetty 1.5.1 Source cves: CVE-2026-40939 Source...