| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks. |
| An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks. |
| A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks. |
| An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files. |
| An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows man-in-the-middle attackers to read arbitrary files and write specific files during support form submission. |
| A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files. |
| A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to falsify check-in status, rooms, drug-screen completion, and tracker history. |
| OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds. |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions. |
| OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable. |
| Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees. |
| An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected. |
| The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0. |
| A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website. |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority, replacedby CVE-2026-70640. |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice. |
| OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions. |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers. |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions. |
