OpenMRS openmrs-core

• CVE-2026-41258 Critical 9.1 OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange 0.3%
• CVE-2026-40076 Critical 9.4 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload 0.9%
• CVE-2026-40075 High 8.2 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet 0.6%
• CVE-2022-23612 High 7.5 Directory Traversal in OpenMRS Startup Filter 1.9%