CVE-2021-40375

CVE-2021-40375 - Broken Access Control in OpenEyes 3.5.1 Description An improper access control vulnerability was identified in OpenEyes 3.5.1, developed by the Apperta Foundation. A low privileged user could load a patient's profile in their browser and access sensitive information without the...

CVE-2026-85260

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260

The Apache Camel MLLP component is vulnerable to Insertion of Sensitive Information into Log File (CWE-532). In affected versions (4.0.0 to before 4.18.5, and 4.19.0 to before 4.22.1), the logPhi option defaulted to true , causing protected health information (PHI) from HL7 clinical messages to b...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

EUVD-2026-104196

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

PT-2026-117355

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

Mobile App Security in HealthTech: Safeguarding Patient Data Against Cybersecurity Threats

HealthTech apps need secure architecture, encrypted data, strong access controls, continuous testing, and post-launch monitoring to protect patient information...

WordPress KiviCare plugin < 4.5.5 - Unauthenticated Patient Data Disclosure vulnerability

Unauthenticated Patient Data Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.5...

CVE-2026-13611

The KiviCare WordPress plugin (a Clinic & Patient Management System / EHR) prior to version 4.5.5 is missing authorization checks on certain REST endpoints , enabling unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

CVE-2026-13611 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

WordPress KiviCare plugin < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR vulnerability

Patient+ Arbitrary Media Attachment Read via IDOR vulnerability discovered by Erwan LR WPScan in WordPress Plugin KiviCare versions 4.5.4...

CVE-2026-19417

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19417

The KiviCare WordPress plugin, in versions prior to 4.5.4 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify if a requesting user is entitled to access specific media files being served. This allows authenticated patient-level users to bypass authoriz...

CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19416 KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

CVE-2026-50576

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

PT-2026-71390

Name of the Vulnerable Software and Affected Versions KiviCare versions prior to 4.5.2 Description The KiviCare WordPress plugin contains a flaw in its unauthenticated registration endpoint that fails to restrict the roles that can be assigned during account creation. This allows an unauthenticat...