Security Advisories

Responsible vulnerability disclosures from our security research.

As part of our security research, we identify and responsibly disclose vulnerabilities in software used in healthcare and critical infrastructure. We work closely with vendors to ensure issues are resolved before publication. Each advisory below documents a confirmed vulnerability along with its impact and recommended mitigation.

ePA-VAU client research

Several advisories below belong to a recurring weakness pattern in lib-vau-based ePA client implementations. We collected them on one page.

View ePA-VAU summary

14 Critical25 High5 Medium44 total

mercure

DICOM Orchestrator

4 Critical5 High1 Medium

mercure

Unauthenticated Remote Code Execution in the DICOM Receiver

Critical 9.82026-05-30

mercure

Code Injection via eval() Sandbox Escape in Routing Rules

Critical 9.12026-05-30

mercure

Server-Side Template Injection in the Notification System

Critical 9.12026-05-30

mercure

Arbitrary Docker Container Configuration Leading to Host Compromise

Critical 9.12026-05-30

mercure

Privilege Escalation via Missing Authorization on User Edit

High 8.82026-05-30

mercure

Pickle Deserialization via Unauthenticated Redis

High 7.82026-05-30

mercure

Command Injection via the subservice Log Parameter

High 7.22026-05-30

mercure

Command Injection via Unquoted Target Fields in Connection Tests

High 7.22026-05-30

mercure

Command Injection via Unquoted SFTP Password

High 7.22026-05-30

mercure

SQL Injection in the Bookkeeper Query Endpoints

Medium 6.52026-05-30

Orthanc

PACS / DICOM Server

3 Critical6 High

Orthanc DICOM Server

Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)

Critical 9.8CVE-2026-54432026-04-02

Orthanc DICOM Server

Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions

Critical 9.8CVE-2026-54422026-04-02

Orthanc DICOM Server

Out-of-Bounds Read in DICOM Image Decoder (DecodeLookupTable)

Critical 9.1CVE-2026-54452026-04-02

Orthanc DICOM Server

Out-of-Bounds Read in DicomStreamReader Meta-Header Parser

High 7.5CVE-2026-54372026-04-02

Orthanc DICOM Server

Memory Exhaustion via Unbounded Content-Length

High 7.5CVE-2026-54402026-04-02

Orthanc DICOM Server

Memory Exhaustion via Forged ZIP Metadata

High 7.5CVE-2026-54392026-04-02

Orthanc DICOM Server

GZIP Decompression Bomb via Content-Encoding Header

High 7.5CVE-2026-54382026-04-02

Orthanc DICOM Server

Out-of-Bounds Read in DICOM Image Decoder (PMSCT_RLE1 Decompression)

High 7.1CVE-2026-54412026-04-02

Orthanc DICOM Server

Heap Buffer Overflow in PAM Image Buffer Allocation

High 7.1CVE-2026-54442026-04-02

gematik

German Healthcare Infrastructure

1 Critical3 High1 Medium

gematik Authenticator

Authentication Flow Hijack

Critical 9.3CVE-2026-338752026-03-26

gematik Authenticator

Remote Code Execution via a Crafted Keychain File

High 7.8CVE-2026-338742026-03-26

gematik lib-vau / lib-vau-csharp

AES-GCM Nonce Reuse in VAU Server Encryption

High 7.42026-05-28

gematik lib-vau / lib-vau-csharp

VAU Handshake Performs Only 2 of 6 Required Server-Key Checks

High 7.42026-05-28

gematik ref-idp-server

Open Redirect via Unvalidated redirect_uri

Medium 6.12026-03-26

fbeta GmbH

ePA3-Service (DiGA-Konnektormodul)

1 Critical2 High1 Medium

fbeta ePA3-Service-OpenSource

VAU Server Authentication Bypass via Circular Certificate Trust

Critical 9.12026-05-28

fbeta ePA3-Service-OpenSource

TLS Certificate Verification Universally Disabled

High 7.52026-05-28

fbeta ePA3-Service-OpenSource

AES-GCM Nonce Reuse via Frozen VAU Request Counter

High 7.42026-05-28

fbeta ePA3-Service-OpenSource

HTTP Header Injection in VAU Inner Requests

Medium 6.82026-05-28

OpenReception

Appointment Booking Software

1 Critical1 High

OpenReception

Unauthenticated WebAuthn Passkey Injection

Critical 9.8CVE-2026-544602026-06-04

OpenReception

Host-Header Injection in Confirmation Emails

High 8.3CVE-2026-582022026-06-04

DCMTK

OFFIS DICOM Toolkit

1 Critical

DCMTK storescp

OS Command Injection via Placeholder Substitution

Critical 9.8CVE-2026-56632026-04-06

OpenMRS

Electronic Medical Record Platform

1 Critical

OpenMRS Core

Stored Velocity SSTI to RCE via ConceptReferenceRange

Critical 9.1CVE-2026-412582026-05-04

pydicom

DICOM Networking Library

1 Critical

pynetdicom

Unauthenticated Path Traversal in the qrscp C-STORE Handler

Critical 9.1CVE-2026-564452026-06-25

SENAITE

Laboratory Information Management System (LIMS)

1 Critical

SENAITE.CORE

Unauthenticated RCE via JSON API RecordsField Eval

Critical 9.8CVE-2026-545692026-07-11

Oviva

ePA Client (Elektronische Patientenakte)

3 High1 Medium

Oviva epa4all-client

VAU Signature Verification Bypass

High 8.1CVE-2026-449002026-05-05

Oviva epa4all-client

TLS Certificate Validation Disabled in Production

High 8.1CVE-2026-455742026-05-11

Oviva epa4all-client

IDP Discovery Document Signature Bypass

High 7.4CVE-2026-455752026-05-11

Oviva epa4all-rest-service

Unauthenticated REST API for Patient Record Writes

Medium 6.5CVE-2026-476722026-05-19

med-united

ePA-Middleware (Primärsystem)

2 High

med-united epa4all

VAU Server Authentication Bypass

High 8.1CVE-2026-480212026-05-20

med-united epa4all

TLS Certificate Verification Disabled

High 8.1CVE-2026-543422026-05-20

Techniker Krankenkasse

GKV SECON Reference Implementation

1 High1 Medium

secon-tool

Signature Verification Bypass via Unsigned CMS Message

High 7.5CVE-2026-623582026-07-15

secon-tool

Sender Impersonation via Certificate Issuer Validation Gap

Medium 6.5CVE-2026-623592026-07-15

OHIF

Web-Based DICOM Viewer

1 High

OHIF Viewer

OIDC Credential Theft via Externally Controlled URL

High 8.2CVE-2026-124732026-05-18

Robert Koch Institut (RKI)

Metadata Exchange Platform

1 High

MEx Backend

Broken Access Control on DELETE Endpoint

High 8.12026-04-10

Upcoming

MS-1a3b8b

Coordinated disclosure in progress.

Pending

MS-7ec1c4

Coordinated disclosure in progress.

Pending