https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:27:58 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-05093 bdu:2026-05093 https://cve.radiocsirt.org/vuln/bdu:2026-05093 https://cve.radiocsirt.org/vuln/euvd-2026-276810 EUVD-2026-276810 https://cve.radiocsirt.org/vuln/euvd-2026-276810 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33305 <p>OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows any authenticated OpenEMR user to invoke controller methods — including `getNotificationLog()`, which returns patient appointment data (PHI) — regardless of whether they hold the required ACL permissions. The `AppDispatch` constructor dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. Version 8.0.0.2 fixes the issue.</p> <p>OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows any authenticated OpenEMR user to invoke controller methods — including `getNotificationLog()`, which returns patient appointment data (PHI) — regardless of whether they hold the required ACL permissions. The `AppDispatch` constructor dispatches user-controlled actions and exits the process before any calling code can enforce ACL checks. Version 8.0.0.2 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33305