# Open-Emr Openemr


- [CVE-2026-24898](https://insights.sbomify.com/CVE-2026-24898/): OpenEMR has an Unauthenticated MedEx Token Disclosure (critical 10.0)
- [CVE-2026-24849](https://insights.sbomify.com/CVE-2026-24849/): OpenEMR Arbitrary File Read Vulnerability (critical 10.0)
- [CVE-2026-24908](https://insights.sbomify.com/CVE-2026-24908/): OpenEMR has SQL Injection in Patient API Sort Parameter (critical 10.0)
- [CVE-2022-2734](https://insights.sbomify.com/CVE-2022-2734/): Improper Restriction of Rendered UI Layers or Frames in openemr/openemr (critical 10.0)
- [CVE-2024-22611](https://insights.sbomify.com/CVE-2024-22611/): SQL injection in n/a (critical 9.8)
- [CVE-2024-37734](https://insights.sbomify.com/CVE-2024-37734/): Privilege escalation in n/a (critical 9.8)
- [CVE-2019-17197](https://insights.sbomify.com/CVE-2019-17197/): SQL injection in n/a (critical 9.8)
- [CVE-2019-14529](https://insights.sbomify.com/CVE-2019-14529/): SQL injection in n/a (critical 9.8)
- [CVE-2018-17179](https://insights.sbomify.com/CVE-2018-17179/): SQL injection in n/a (critical 9.8)
- [CVE-2018-17181](https://insights.sbomify.com/CVE-2018-17181/): SQL injection in n/a (critical 9.8)
- [CVE-2018-15143](https://insights.sbomify.com/CVE-2018-15143/): SQL injection in n/a (critical 9.8)
- [CVE-2018-15145](https://insights.sbomify.com/CVE-2018-15145/): SQL injection in n/a (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/open-emr/openemr/