CVE-2026-105667
HighCVSS 7.5Summary
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another, and the archive's unmerge does not reverse this.
Risk Assessment
An unauthenticated attacker can redirect patient medical data to wrong identities, causing serious medical record errors and patient safety risks.
Recommendation
Enable authentication of sending applications in the HL7 listener and restrict network access to this interface.
Related vulnerabilities
- CVE-2026-78162Critical
A deserialization of untrusted data vulnerability in Apache Camel affects the camel-hazelcast component. Two configuration paths (ReplicatedHazelcastAggregationRepository and client mode in HazelcastDefaultComponent) fail to apply the JavaSerializationFilterConfig, allowing an attacker to achieve remote code execution by injecting a malicious Java object into the Hazelcast cluster.
- CVE-2026-111406Critical
The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.
- CVE-2026-110887Critical
The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.
- CVE-2026-103091Critical
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain Missing Authorization (CWE-862) and Insecure Default Initialization (CWE-1188) in the MCP proxy and OIDC registration flow. Public disclosure of OIDC configuration via GET /info and auto-enrollment of any valid OIDC token holder via POST /register without claim filtering or ban checks allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.
- CVE-2026-102503Critical
Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.
- CVE-2026-108983Critical
A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.
- CVE-2026-111998Critical
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
- CVE-2026-110886Critical
The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.
- CVE-2026-110372Critical
The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.
- CVE-2026-109894Critical
The Booktics plugin (up to version 1.0.29) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.
Original NVD description (English source)
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS