The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126455: openemr: OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal,…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126454: openemr: OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126453: openemr: OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126452: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126451: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript…7.3 High8.5 HighN/ANov 13, 2026
CVE-2026-126450: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject…5.0 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126449: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126448: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126447: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126446: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126445: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126444: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126443: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126442: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126441: openemr: OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126440: openemr: OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers,…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126439: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126438: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126437: openemr: OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126436: openemr: OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126435: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126434: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126433: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126432: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126431: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination…6.8 Medium7.6 HighN/ANov 13, 2026
451-475 of 532044