en
OpenMRS is a global open-source electronic medical record platform and community project for digital health. It provides a configurable foundation for clinical information management, supports standards-based interoperability, and is intended for healthcare organizations, implementers, clinicians, and public health programs operating in varied resource and infrastructure environments.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/19/2026, openmrs recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, org.openmrs.module:legacyui-api had the most security vulnerabilities in the openmrs ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-44715OpenMRS has Broken Access Control in HL7 ConfigurationCVE-2026-41258OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRangeCVE-2026-40076OpenMRS Core arbitrary file write and code execution via Zip Slip in module uploadCVE-2026-40075OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServletCVE-2025-46823OpenMRS has Vulnerability in FHIR2 Module Privileges| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-44715OpenMRS has Broken Access Control in HL7 Configuration | Exploitation statusNot exploited | FixNo | Affected productorg.openmrs.module:legacyui-api | Published09/11/2026 | SeverityHigh |
CVE-2026-41258OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange | Exploitation statusNot exploited | FixYes | Affected productopenmrs-core | Published | |
CVE-2026-40076OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload | Exploitation statusActively exploited | FixYes | Affected productopenmrs-core | Published | |
CVE-2026-40075OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet | Exploitation statusActively exploited | FixYes | Affected productopenmrs-core | Published | |
CVE-2025-46823OpenMRS has Vulnerability in FHIR2 Module Privileges | Exploitation statusNot exploited | FixNo | Affected productopenmrs-module-fhir2 | Published05/29/2025 | |
CVE-2025-25927CVE-2025-25927 | Exploitation statusActively exploited | FixNo | Affected product- | Published03/11/2025 | SeverityMedium |
CVE-2025-25928CVE-2025-25928 | Exploitation statusActively exploited | FixNo | Affected product- | Published03/11/2025 | SeverityHigh |
CVE-2025-25925CVE-2025-25925 | Exploitation statusActively exploited | FixNo | Affected product- | Published03/11/2025 | SeverityMedium |
CVE-2025-25929CVE-2025-25929 | Exploitation statusActively exploited | FixNo | Affected product- | Published03/11/2025 | SeverityMedium |
CVE-2020-36636OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting | Exploitation statusNot confirmed | FixYes | Affected productAdmin UI Module | Published |
34 Results | Page 1 of 4
| SeverityCritical |
| SeverityCritical |
| SeverityHigh |
| SeverityHigh |
| SeverityLow |