OpenEMR versions before 8.4.0 have an authorization bypass vulnerability in the FHIR Media/:uuid and QuestionnaireResponse read routes. This flaw allows non-patient API tokens without OpenEMR ACLs to access any patient's documents and questionnaire responses by UUID, bypassing compartment filtering and ACL checks.
OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting (XSS) vulnerability in the CCDA/CCD preview stylesheets. This flaw allows authenticated users to upload crafted CCDA/CCD documents with malicious event-handler attributes that execute scripts in a clinician's session upon previewing. The vulnerability arises from improper neutralization of input in cda.xsl and ccd.xsl files, where event-handler and table-cell attributes are copied unsanitized or evade filtering.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in the OnsitePortalActivityController::Update() function. This flaw allows authenticated portal patients to manipulate the patientId parameter in PUT requests to the onsiteportalactivity API, enabling them to access and modify other patients' activity records. Exploitation can lead to disclosure of sensitive data, overwriting of narratives and status fields, and unauthorized ownership takeover of records.
OpenEMR versions prior to 8.3.0 contain a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions. This flaw allows authenticated low-privilege users to read and overwrite arbitrary files on the server by exploiting an unsanitized file_path parameter. Attackers can download sensitive files such as database credentials or overwrite writable files with arbitrary content. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions from 7.0.1 up to but not including 8.4.0 have a vulnerability in the OneTimeAuth.php component where authentication tokens are not properly revoked and PIN checks lack rate limiting and strict comparison. This flaw allows attackers who have captured a token to replay it or brute-force the PIN to access patient portal sessions, potentially exposing protected health information (PHI).
OpenEMR versions prior to 8.4.0 contain a SQL injection vulnerability in the patient portal's OnsiteDocument query API. Authenticated users can exploit this flaw by injecting SQL through bitwise criteria filter parameters, allowing unauthorized reading of any database table, including sensitive patient and staff data. The vulnerability is fixed in version 8.4.0.
CVE-2026-124443 is a broken access control vulnerability in the Frappe Framework versions before 15.121.1 and 16.x before 16.35.0. It allows authenticated users to query file lists or report views and obtain metadata of private files they are not authorized to access.
AzuraCast versions prior to 0.24.0 contain a server-side request forgery (SSRF) vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF protection via HTTP redirects. This enables attackers to configure certain webhooks to indirect URLs that cause the internal Guzzle HTTP client to access internal services and expose responses in test logs. The vulnerability is fixed in version 0.24.0.
Kyverno versions before 1.19.2 have an authorization bypass vulnerability that allows namespaced tenants to create resources of any kind in any namespace by manipulating generate rule templates. This can lead to attackers creating policies that cause the privileged background-controller to write sensitive resources such as NetworkPolicies or RoleBindings into namespaces they should not control, including kube-system. The vulnerability is fixed in version 1.19.2.
Kyverno versions from 1.19.1 up to but not including 1.19.2 contain an authorization bypass vulnerability in the apiCall namespace clamp. This flaw allows namespace tenants to issue cross-namespace and cluster-scoped API requests by exploiting malformed percent-escapes in the urlPath. Attackers can create namespaced Policies that execute apiCall operations as the admission-controller ServiceAccount, enabling them to read resources in other namespaces and create mutating webhooks, potentially escalating privileges to cluster admin.
CVE-2026-124439 is a high-severity vulnerability in Scriban versions before 7.5.3 involving uncontrolled recursion. The flaw allows postfix member, indexer, and call chains to bypass expression depth limits, and array comparisons lack necessary depth and cycle checks. Additionally, object.eval bypasses recursive limits. An attacker who can supply templates may trigger an uncatchable StackOverflowException that terminates the host process. This vulnerability is fixed in version 7.5.3.
Scriban versions before 7.5.2 have a critical vulnerability that allows template authors to use reflection to access .NET internals of function values. This flaw enables attackers to read and overwrite sensitive information such as service properties, captured closure secrets, and assembly paths by exploiting array.map on imported delegates. The issue is fixed in version 7.5.2.
Scriban versions before 7.5.3 have a resource exhaustion vulnerability that allows untrusted template authors to consume excessive memory and CPU. This occurs because certain built-in functions bypass allocation guards, enabling attackers to craft templates that cause crashes or stalls in multi-tenant environments.
OpenRemote core versions before 1.32.2 have an improper authorization vulnerability allowing realm administrators to access and modify global resources without super administrator checks. This flaw enables attackers to change the global keycloakUrl, potentially redirecting authentication flows for credential phishing, injecting malicious CSS, replacing map tiles, and deleting logs.
OpenRemote core versions before 1.32.2 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with write:admin permissions can upload HTML or SVG files containing malicious JavaScript via the Manager configuration file upload endpoint. These files can then be accessed through an unauthenticated image retrieval endpoint that serves them with text/html or image/svg+xml content types, leading to script execution in the context of the application origin.
A vulnerability in the Grav Lightbox Gallery plugin versions 1.1.0 through before 1.3.2 allows a page editor to execute unauthorized methods via shortcode values. This flaw enables reading of server-readable YAML files containing sensitive information such as password hashes, 2FA secrets, and API keys, exposing them publicly. The issue is fixed in version 1.3.2.
phpMyFAQ versions prior to 4.1.11 have an insufficient authorization vulnerability allowing delegated administrators with only GROUP_DELETE permission to delete higher-privileged groups. This flaw enables attackers to remove privileged groups, their memberships, and permission mappings by submitting crafted requests to specific admin endpoints. The issue is fixed in version 4.1.11.
phpMyFAQ versions 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 have an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint. This endpoint returns stable credential IDs for passkey-registered accounts but a time-derived fallback ID for others, allowing attackers to distinguish existing accounts by comparing responses over time. The vulnerability has no rate limiting and can be exploited without authentication.
Craft CMS versions from 5.10.0 up to but not including 5.11.2 have an authorization bypass vulnerability. This flaw allows authenticated users with low privileges to browse volumes they should not have access to. Specifically, attackers can delete a linked asset and then use the replacement volume browser modal to view the directory structures of all volumes, although they cannot view file contents. The issue is fixed in version 5.11.2.
Craft CMS versions from 5.10.0 up to but not including 5.11.2 contain a remote code execution vulnerability. This flaw allows non-administrator control panel users to obtain HMAC-signed Twig templates via the app/render-elements endpoint. By submitting a signed template returnUrl as the login redirect parameter, attackers can trigger unsandboxed evaluation of renderObjectTemplate(), leading to execution of OS commands as the PHP worker. The vulnerability is fixed in version 5.11.2.