Priority MEDIUM 48
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE.
J4Care
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
J4Care records in CISA KEVNo J4Care vulnerabilities are listed in CISA KEV.
Records
6 records
Priority MEDIUM 44
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states.
Priority MEDIUM 44
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
TI-2026-75324 CVE-2026-105273
J4Care dcm4che Loop with Unreachable Exit Condition
Priority MEDIUM 44
MP4Parser does not adequately validate MP4 box sizes.
Priority MEDIUM 44
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying.
Priority MEDIUM 43
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.