LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Santesoft

Santesoft

Santesoft in MedDevice Cyber coverage: 6 stories, 3 products named, 9 CVEs, and the company's own disclosures.

Follow SantesoftClaim this page
Stories
6
Products named
3
Product CVEs
9
Responses on record
0
Latest story
Aug 12, 2025

Coverage

6 stories
01
Vulnerability

Five flaws in Sante PACS Server, and one sends credentials in cleartext

ICSMA-25-224-01 covers five bugs in Santesoft Sante PACS Server before 4.2.3, including a double free that crashes the archive on a crafted HL7 message and a web portal that transmits credentials in the clear.

CISAAug 123 min read
02
Vulnerability

Two rounds of memory-corruption bugs in one DICOM viewer

CISA hit Sante DICOM Viewer Pro twice in 2025: an out-of-bounds write (ICSMA-25-079-01) and later an out-of-bounds read (ICSMA-25-148-01), both triggered by opening a crafted file.

CISAMar 202 min read
03
Vulnerability

Santesoft Sante FFT Imaging 1.4.1 has an out-of-bounds write in DCM file handling

CISA advisory ICSMA-24-065-01 covers CVE-2024-1696 (CWE-787, CVSS 7.8), an out-of-bounds write in Santesoft Sante FFT Imaging 1.4.1 and prior triggered by opening a malicious DCM file. Version 1.4.2 fixes it.

CISAMar 52 min read
04
Vulnerability

Santesoft Sante DICOM Viewer Pro 14.0.3 out-of-bounds read triggered by a malicious DICOM file

CISA advisory ICSMA-24-058-01 covers CVE-2024-1453 (CWE-125, CVSS 7.8), an out-of-bounds read in Santesoft Sante DICOM Viewer Pro 14.0.3 and prior that a malicious DICOM file can turn into code execution. Version 14.0.4 fixes it. Michael Heinzl reported it.

CISAFeb 272 min read
05
Vulnerability

Santesoft Sante DICOM Viewer Pro has two memory corruption flaws in DICOM parsing

CISA advisory ICSMA-23-285-01 covers an out-of-bounds write (CVE-2023-39431) and a stack-based buffer overflow (CVE-2023-35986), each CVSS 7.8, in Santesoft Sante DICOM Viewer Pro 12.2.4 and prior. Version 12.2.6 fixes both.

CISAOct 122 min read
06
Vulnerability

Santesoft Sante FFT Imaging has an out-of-bounds read when parsing DICOM files

CISA advisory ICSMA-23-285-02 covers CVE-2023-5059 (CWE-125, CVSS v3 7.8), an out-of-bounds read in DICOM parsing in Santesoft Sante FFT Imaging 1.4.0 and earlier that can lead to code execution. Version 1.4.1 fixes it.

CISAOct 122 min read

Products in our coverage

CVEs in coverage of Santesoft products

CVE-2023-35986 CVE-2023-39431 CVE-2023-5059 CVE-2024-1453 CVE-2024-1696 CVE-2025-2480 CVE-2025-5307 CVE-2025-53948 CVE-2025-54156
← All manufacturers