These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-87020 is an integer overflow vulnerability in Orthanc DICOM Server's PNG decoding, leading to a heap out-of-bounds write. The vulnerability has a CVSS score of 7.2 and is considered HIGH severity. The CVE record was published on 2026-09-11T15:17:06.937Z and has not been modified since then. This vulnerability affects Orthanc DICOM Server's handling of PNG files, which could lead to potential secu [truncated]
A stored cross-site scripting (XSS) vulnerability exists in Orthanc Explorer 2 up to version 1.12.0. The flaw resides in the URL handler within `WebApplication/src/components/StudyList.vue`, where the `remote-source` argument is not properly sanitized before rendering. An attacker can inject malicious scripts through this parameter, which execute in the context of a victim's browser session when interacti [truncated]
CVE-2025-0896 affects Orthanc Server versions prior to 1.5.8. According to the CISA CSAF advisory, when remote access is enabled, basic authentication is not enabled by default, which can leave the service open to unauthorized access. The advisory rates the issue CVSS 9.8 (Critical). Orthanc advises updating to the latest version or explicitly enabling HTTP authentication by setting AuthenticationEnabled [truncated]
A stored cross-site scripting (XSS) vulnerability exists in the Orthanc Osimis WebViewer, a DICOM medical imaging viewer used in healthcare environments. The flaw allows an attacker to embed malicious JavaScript payloads within DICOM study metadata. When a healthcare practitioner or administrator subsequently views the compromised study through the web interface, the embedded script executes in the victim [truncated]