Login Request a demo
DH
Product
dhis2-core
by dhis2 · last CVE Oct 1, 2026
10
CVEs
0
On KEV
9.1
Max CVSS
1
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 1High 5Medium 4Low 0
Severity
All severities10Critical1High5Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add dhis2-core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55083
9.1
1%
Oct 1
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
Affected: >= 2.42.0, < 2.42.5.1; >= 2.43.0, < 2.43.0.1
CVE-2026-55084
8.8
0%
Jul 21
SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
Affected: >= 2.37, <= 2.39; >= 2.40.0, < 2.40.11.1; >= 2.41.0, < 2.41.8.2; >= 2.42.0, < 2.42.5.1; >= 2.43.0, < 2.43.0.1
CVE-2026-55082
8.7
1%
Jul 21
DHIS2 SQL injection in SQL View filter values
Affected: = 2.37; = 2.38; = 2.39
CVE-2023-31139
7.5
1%
May 9
DHIS2 Core unrestricted session cookies with Personal Access Tokens
Affected: >= 2.37, < 2.37.9.1; >= 2.38, < 2.38.3.1; >= 2.39, < 2.39.1.2
CVE-2026-55081
7.3
0%
Jul 21
DHIS2 Reflected XSS in OpenAPI HTML scope parameter
Affected: >= 2.42.0, < 2.42.5.1; >= 2.43.0, < 2.43.0.1
CVE-2022-41948
7.2
1%
Dec 8
Privilege Chaining with the user admin role in dhis2-core
Affected: < 2.36.12.1; >= 2.37.0.0, < 2.37.8.1; >= 2.38.0.0, < 2.38.2.1; >= 2.39.0.0, < 2.39.0.1
CVE-2023-32060
6.5
1%
May 9
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
Affected: >= 2.35, < 2.36.13; >= 2.37, < 2.37.8; >= 2.38, < 2.38.2
CVE-2023-31138
6.5
1%
May 9
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
Affected: >= 2.36, < 2.37.9.1; >= 2.38, < 2.38.3.1; >= 2.39, < 2.39.1.2
CVE-2022-41947
5.4
0%
Dec 8
Cross-site Scripting with user-uploaded files in dhis2-core
Affected: < 2.36.12.1; >= 2.37.0.0, < 2.37.8.1; >= 2.38.0.0, < 2.38.2.1; >= 2.39.0.0, < 2.39.0.1
CVE-2022-41949
4.3
0%
Dec 8
Semi-blind Server-Side Request Forgery in dhis2-core
Affected: < 2.36.12.1; >= 2.37.0.0, < 2.37.8.1; >= 2.38.0.0, < 2.38.2.1; >= 2.39.0.0, < 2.39.0.1
Showing 10