CompuGroup Medical
Vulnerability activity for CompuGroup Medical: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 10
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 10
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 10
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.2HighNov 9, 2026CompuGroup Medical InfantiaCVE-2026-118468XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
- 4.3MediumNov 9, 2026CompuGroup Medical Infantia Information disclosureCVE-2026-118467Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
- 5.8MediumNov 9, 2026CompuGroup Medical Infantia Auth bypass / access controlCVE-2026-118465Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
- 5.8MediumNov 9, 2026CompuGroup Medical Infantia Crypto / certificateCVE-2026-118464Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.
- 9.2CriticalNov 9, 2026CompuGroup Medical InfantiaCVE-2026-118462Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- 8.0HighNov 9, 2026CompuGroup Medical Infantia Auth bypass / access controlCVE-2026-118461The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- 8.0HighNov 9, 2026CompuGroup Medical Infantia Crypto / certificateCVE-2026-118460Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
- 6.3MediumNov 9, 2026CompuGroup Medical Infantia Auth bypass / access controlCVE-2026-118459A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
- 8.1HighNov 9, 2026CompuGroup Medical Phronesis Auth bypass / access controlCVE-2026-118458The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
- 5.9MediumNov 9, 2026CompuGroup Medical Venere Privilege escalationCVE-2026-118450Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
Top products
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.