Vendors / OFFIS DICOM Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 4
Exploited now OFFIS DICOM records in CISA KEV No OFFIS DICOM vulnerabilities are listed in CISA KEV.
Priority MEDIUM 49
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00664 · Published 2026-06-30 · No fix listed CWE-22
Priority MEDIUM 45
An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area.
CVSS 4.0 HIGH 8.8· Network · No auth · No interaction · EPSS 0.00492 · Published 2026-06-30 · No fix listed CWE-22
Priority MEDIUM 45
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00646 · Published 2026-06-30 · No fix listed CWE-401
Priority MEDIUM 45
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00636 · Published 2026-06-30 · No fix listed CWE-843
Priority MEDIUM 45
An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00646 · Published 2026-06-30 · No fix listed CWE-401
Open these records in search → All records by CVSS severity
1 4 0 0 0
THREATIST.IORead the docs