Login Request a demo
DH
Product
dhis2-core
by dhis2 · last CVE Oct 1, 2026
10
CVEs
0
On KEV
9.1
Max CVSS
1
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 1High 5Medium 4Low 0
Severity
All severities10Critical1High5Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add dhis2-core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-32060
6.5
1%
May 9
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
Affected: >= 2.35, < 2.36.13; >= 2.37, < 2.37.8; >= 2.38, < 2.38.2
CVE-2023-31138
6.5
1%
May 9
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
Affected: >= 2.36, < 2.37.9.1; >= 2.38, < 2.38.3.1; >= 2.39, < 2.39.1.2
CVE-2022-41947
5.4
0%
Dec 8
Cross-site Scripting with user-uploaded files in dhis2-core
Affected: < 2.36.12.1; >= 2.37.0.0, < 2.37.8.1; >= 2.38.0.0, < 2.38.2.1; >= 2.39.0.0, < 2.39.0.1
CVE-2022-41949
4.3
0%
Dec 8
Semi-blind Server-Side Request Forgery in dhis2-core
Affected: < 2.36.12.1; >= 2.37.0.0, < 2.37.8.1; >= 2.38.0.0, < 2.38.2.1; >= 2.39.0.0, < 2.39.0.1
Showing 4