Tools / openemr / Security

Security Deep Dive

openemr

Security posture and CVE patch evidence from tracked releases.

Back to Tool

18 high-severity dependency CVEs affects v8_1_0.

Review the dependency vulnerabilities below.

— Signed — SLSA — SBOM ✗ Security policy Monthly cadence · 35d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present

Signed releases Unknown

Latest release artifact signature Latest release

—

SLSA provenance Unknown

Attestation predicate level Latest release

—

SBOM published Unknown

GitHub SBOM API Latest release

—

SECURITY.md Absent

GitHub repository metadata Repository policy

Checked: 18d ago

Release cadence: monthly Present

35d median over recent releases Release history

Latest release: 5d ago

Maintainer active Present

Recent commit activity Repository

Last commit: 2d ago

Checksums (SHA256SUMS) Not active yet

SHA256SUMS or equivalent Release asset

Latest release: 5d ago

GitHub Actions attestation Not active yet

actions/attest-build-provenance Workflow file

Latest release: 5d ago

Signing assets Not active yet

.sig, .crt, cosign.pub, or similar Release asset

Latest release: 5d ago

3.4/10 Security Score

4.2/10 Scorecard

Pending CVE Patch Speed

Open CVEs Open CVEs detected for latest version.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

2d stale

scorecard

1.68 / 4.0

Score 4.2/10

cve health

0.00 / 2.5

Open CVEs detected

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 36.8/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: open cve scan: available

Release responsiveness

release responsiveness

10.0

patch speed days: no_history

Dependency exposure

dependency exposure

6.3

10%

supply chain risk: 36.77 transitive cves: 0c/18h

Provenance trust

provenance trust

4.2

40%

scorecard score: 4.2 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 2d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none

How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 36.8/100

0 Transitive critical CVEs

0 KEV-transitive CVEs

62% Dependency freshness

Scorecard

Scorecard 4.2/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check	Score	Reason
Code-Review	2	Found 1/5 approved changesets -- score normalized to 2
Maintained	10	30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Packaging	-1	packaging workflow not detected
CII-Best-Practices	0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	-1	No tokens found
Dangerous-Workflow	-1	no workflows found
Security-Policy	0	security policy file not detected
License	10	license file detected
Signed-Releases	0	Project has not signed or included provenance with any releases.
Branch-Protection	3	branch protection is not maximal on development and all release branches
SAST	10	SAST tool is run on all commits
Binary-Artifacts	7	binaries present in source code
Pinned-Dependencies	-1	no dependencies found
Fuzzing	0	project is not fuzzed

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

2137 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

High

Medium

Low

Unknown

Still affecting latest (41) All (44)

High 18 Medium 18 Low 5

CVE	Severity	KEV	Dependency	Affected version	Cleared in release
CVE-2021-32804	high	—	tar	2.2.2	v8_1_0
CVE-2021-37713	high	—	tar	2.2.2	v8_1_0
CVE-2024-21490	high	—	angular	1.8.3	v8_1_0
CVE-2024-21538	high	—	cross-spawn	7.0.3	v8_1_0
CVE-2024-4068	high	—	braces	2.3.2	v8_1_0
CVE-2026-23745	high	—	tar	2.2.2	v8_1_0
CVE-2026-23950	high	—	tar	2.2.2	v8_1_0
CVE-2026-24842	high	—	tar	2.2.2	v8_1_0
CVE-2026-26960	high	—	tar	2.2.2	v8_1_0
CVE-2026-26996	high	—	minimatch	3.0.8	v8_1_0
CVE-2026-27903	high	—	minimatch	3.0.8	v8_1_0
CVE-2026-27904	high	—	minimatch	3.0.8	v8_1_0
CVE-2026-29786	high	—	tar	2.2.2	v8_1_0
CVE-2026-31802	high	—	tar	2.2.2	v8_1_0
CVE-2026-42334	high	—	mongoose	7.8.8	v8_1_0
CVE-2026-4800	high	—	lodash	4.17.23	v8_1_0
CVE-2026-6321	high	—	fast-uri	3.0.6	v8_1_0
GHSA-5c6j-r48x-rmvq	high	—	serialize-javascript	6.0.2	v8_1_0
CVE-2020-26308	medium	—	validate.js	0.13.1	v8_1_0
CVE-2021-23413	medium	—	jszip	3.2.2	v8_1_0
CVE-2022-25844	medium	—	angular	1.8.3	v8_1_0
CVE-2022-25869	medium	—	angular	1.8.3	v8_1_0
CVE-2022-33987	medium	—	got	7.1.0	v8_1_0
CVE-2022-48285	medium	—	jszip	3.2.2	v8_1_0
CVE-2023-26116	medium	—	angular	1.8.3	v8_1_0
CVE-2023-26117	medium	—	angular	1.8.3	v8_1_0
CVE-2023-26118	medium	—	angular	1.8.3	v8_1_0
CVE-2023-44270	medium	—	postcss	7.0.39	v8_1_0
CVE-2024-28863	medium	—	tar	2.2.2	v8_1_0
CVE-2024-4067	medium	—	micromatch	2.3.11	v8_1_0
CVE-2025-2336	medium	—	angular-sanitize	1.8.3	v8_1_0
CVE-2026-2950	medium	—	lodash	4.17.23	v8_1_0
CVE-2026-33532	medium	—	yaml	2.7.0	v8_1_0
CVE-2026-33750	medium	—	brace-expansion	1.1.11	v8_1_0
CVE-2026-34043	medium	—	serialize-javascript	6.0.2	v8_1_0
CVE-2026-41305	medium	—	postcss	7.0.39	v8_1_0
CVE-2024-8372	low	—	angular	1.8.3	v8_1_0
CVE-2024-8373	low	—	angular	1.8.3	v8_1_0
CVE-2025-0716	low	—	angular	1.8.3	v8_1_0
CVE-2025-5889	low	—	brace-expansion	1.1.11	v8_1_0
CVE-2026-24001	low	—	diff	7.0.0	v8_1_0

Showing 41 of 44