The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126493: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal…5.4 Medium4.8 MediumN/ANov 13, 2026
CVE-2026-126492: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126491: openemr: OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options…7.6 High8.3 HighN/ANov 13, 2026
CVE-2026-126490: openemr: OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and…3.1 Low2.3 LowN/ANov 13, 2026
CVE-2026-126489: openemr: OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-126488: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-126487: openemr: OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126486: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal…7.6 High7.2 HighN/ANov 13, 2026
CVE-2026-126485: openemr: OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126484: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126483: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126482: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php,…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126481: openemr: OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows…8.1 High7.2 HighN/ANov 13, 2026
CVE-2026-126480: openemr: OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126479: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions…7.6 High7.2 HighN/ANov 13, 2026
CVE-2026-126478: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the…7.6 High7.2 HighN/ANov 13, 2026
CVE-2026-126477: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows…4.8 Medium4.6 MediumN/ANov 13, 2026
CVE-2026-126476: openemr: OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126475: openemr: OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126474: openemr: OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126473: openemr: OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers…9.1 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-126472: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126471: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126470: openemr: OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126469: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on…8.8 High8.7 HighN/ANov 13, 2026
351-375 of 532044