CVE-2026-62293

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11.

• CWE-20
• CWE-79

• https://github.com/hapifhir/org.hl7.fhir.core/commit/3a9befd8845f003095ed75f4b24b9a80630275be
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw

Published

Aug 7, 2026

Last Modified

Aug 7, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6226The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-6227The BackWPup plugin for WordPress is vulnerable to Local Fil…7.2
• CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62287Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6229The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
• CVE-2026-62290cert-manager adds certificates and certificate issuers as re…7.3
• CVE-2026-62294Flameshot is powerful yet simple to use screenshot software.…5.1
• CVE-2026-62295HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-62296HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-62299CoreDNS is a DNS server written in Go. Prior to 1.14.5, the …5.3
• CVE-2026-6230The Tainacan plugin for WordPress is vulnerable to time-base…7.5
• CVE-2026-62309CoreDNS is a DNS server written in Go. Prior to 1.14.4, a si…7.5