Vendor

hapifhir

15 known vulnerabilities.

Products

org.hl7.fhir.core 15 ca.uhn.hapi.fhir:org.hl7.fhir.validation 3 ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 3 ca.uhn.hapi.fhir:org.hl7.fhir.r5 2 ca.uhn.hapi.fhir:org.hl7.fhir.utilities 2

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 5.0

CVE-2026-62293

HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.htm…

hapifhir org.hl7.fhir.core ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli ca.uhn.hapi.fhir:org.hl7.fhir.validation

Aug 7, 2026
Medium 5.8

CVE-2026-34360

HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and makes server-side HTTP …

hapifhir org.hl7.fhir.core ca.uhn.hapi.fhir:org.hl7.fhir.core Maven

Mar 31, 2026