LIVE FEED

A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.

Manufacturers // Smile Digital Health

Smile Digital Health

Smile Digital Health in MedDevice Cyber coverage: 1 story, 2 products named, 4 CVEs, and the company's own disclosures.

Follow Smile Digital Health Claim this page

Stories: 1
Products named: 2
Product CVEs: 4
Responses on record: 0
Latest story: Oct 22, 2026

Coverage

1 story

Four unpatched flaws disclosed in HAPI FHIR, the server library behind Smile CDR

A researcher found four flaws in HAPI FHIR, the open-source Java library that underpins Smile Digital Health's Smile CDR and at least eight other commercial platforms. The worst, CVE-2026-113874 at 8.1 on CVSS v3.1, lets an authenticated user override the partition header on a Bundle entry and read or write another tenant's clinical data. None of the four has a confirmed fix yet.

oss-security mailing listOct 223 min read

Products in our coverage

HAPI FHIR 8.10.0, 8.8.2, 8.10.1, 8.12.1 open-source FHIR server library
Smile CDR 2026.05.R01 clinical data repository platform

CVEs in coverage of Smile Digital Health products

CVE-2026-113873 CVE-2026-113874 CVE-2026-113875 CVE-2026-113876

← All manufacturers