Known vulnerabilities in FHIR

Vendor: HAPI FHIR
Software: FHIR
Software CPE: cpe:2.3:a:hapifhir:fhir:*:*:*:*:*:*:*:*
Total vulnerabilities: 16
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FHIR FHIR is affected by 16 known vulnerabilities: 5 high, 10 medium, 1 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137480 - Uncontrolled Recursion
CVE-2026-62295
CWE-674 Medium
No
No
6.9.11 14.07.2026 SB2026071460
#VU137479 - Uncontrolled Recursion
CVE-2026-62296
CWE-674 Medium
No
No
6.9.11 14.07.2026 SB2026071460
#VU137478 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-62293
CWE-79 Medium
No
No
6.9.11 14.07.2026 SB2026071460
#VU137477 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2026-55471
CWE-611 Medium
No
No
6.9.10 14.07.2026 SB2026071459
#VU137476 - Inefficient Regular Expression Complexity
CVE-2026-55470
CWE-1333 Medium
No
No
6.9.10 14.07.2026 SB2026071459
#VU137475 - Improper input validation
CVE-2026-49485
CWE-20 Medium
No
No
6.9.4.2, 6.9.9 14.07.2026 SB2026071458
#VU137474 - Inefficient Regular Expression Complexity
CVE-2026-45367
CWE-1333 Medium
No
No
6.9.7 14.07.2026 SB2026071457
#VU129396 - Insufficiently Protected Credentials
CVE-2026-34361
CWE-522 High
Available
No
6.9.4 04.05.2026 SB2026050448
#VU129395 - Origin Validation Error
CVE-2026-34359
CWE-346 High
Available
No
6.9.4 04.05.2026 SB2026050448
#VU129394 - Server-Side Request Forgery (SSRF)
CVE-2026-34360
CWE-918 Medium
Available
No
6.9.4 04.05.2026 SB2026050448
#VU129393 - Exposure of sensitive information to an unauthorized actor
CVE-2026-33180
CWE-200 Medium
No
No
6.8.3 04.05.2026 SB2026050447
#VU100928 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-51132
CWE-611 High
No
No
6.4.0 26.11.2024 SB2024112640
SB2024112661
#VU100927 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-52007
CWE-611 High
No
No
6.4.0 26.11.2024 SB2024112640
SB2024112661
#VU97959 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-45294
CWE-611 High
No
No
6.3.23 02.10.2024 SB2024100240
SB2024100242
SB2024100249
and 2 more
#VU137472 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-28465
CWE-22 Medium
No
No
5.6.106 10.03.2023 SB2023031054
#VU137473 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-24057
CWE-22 Low
No
No
5.6.92 23.01.2023 SB2023012388