PaperCut

Latest CVEs · RSS

• CVE-2026-11744 2026-09-24 · CVSS 3.8
  An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received
• CVE-2026-87739 2026-09-24 · CVSS 6.9
  An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generat
• CVE-2026-82077 2026-09-24 · CVSS 7.3
  An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows
• CVE-2026-14780 2026-09-24 · CVSS 7.5
  A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embed
• CVE-2026-82078 2026-08-28 · CVSS 9.4
  An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database
• CVE-2026-81578 2026-08-28 · CVSS 8.8
  An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remot
• CVE-2026-8794 2026-08-03 · CVSS 6.9
  PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to p
• CVE-2026-8793 2026-08-03 · CVSS 6.9
  PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vuln
• CVE-2026-6645 2026-06-22 · CVSS 7.3
  An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, whi
• CVE-2026-7824 2026-05-05 · CVSS 5.9
  An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently rec
• CVE-2026-6418 2026-05-05 · CVSS 4.6
  An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configur
• CVE-2026-6180 2026-05-05 · CVSS 4.1
  A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropp
• CVE-2026-5115 2026-03-31 · CVSS 3.6
  The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded applicati
• CVE-2026-4794 2026-03-31 · CVSS 2.1
  Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or H
• CVE-2025-9785 2025-09-03 · CVSS 7.7
  PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is dep
• CVE-2024-9672 2024-12-09 · CVSS 6.3
  A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the br
• CVE-2024-8404 2024-09-26 · CVSS 7.8
  An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability,
• CVE-2024-8405 2024-09-26 · CVSS 6.1
  An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the
• CVE-2024-4712 2024-05-14 · CVSS 7.8
  An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the
• CVE-2024-3037 2024-05-14 · CVSS 7.8
  An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability,
• CVE-2024-1884 2024-03-14 · CVSS 6.5
  This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side applicati
• CVE-2024-1883 2024-03-14 · CVSS 6.3
  This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious U
• CVE-2024-1882 2024-03-14 · CVSS 7.2
  This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server host
• CVE-2024-1654 2024-03-14 · CVSS 7.2
  This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin a
• CVE-2024-1223 2024-03-14 · CVSS 4.8
  This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of