The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126474: openemr: OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126473: openemr: OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers…9.1 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-126472: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126471: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126470: openemr: OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126469: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126468: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126467: openemr: OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126466: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126465: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126464: openemr: OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126463: openemr: OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126462: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126461: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126460: openemr: OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126458: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126457: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126456: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126455: openemr: OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal,…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126454: openemr: OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126453: openemr: OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126452: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126451: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript…7.3 High8.5 HighN/ANov 13, 2026
CVE-2026-126450: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject…5.0 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126449: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and…7.1 High7.1 HighN/ANov 13, 2026
176-200 of 560969