Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Sep 24, 2026An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation.CVE-2026-87739 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.9
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allowsCVE-2026-82077 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4High 7.3
An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedCVE-2026-14780 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4High 7.5
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026PaperCut NG/MF Unsafe Reflection VulnerabilityCVE-2026-82078 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4ExploitedCritical 9.4
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
- Product
- NG/MF
- On CISA’s list since
- Aug 31, 2026 (federal fix deadline Sep 14, 2026)
- What to do
- Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpapercut.comgithub.com
Aug 28, 2026PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityCVE-2026-81578 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4ExploitedHigh 8.8
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
- Product
- NG/MF
- On CISA’s list since
- Aug 31, 2026 (federal fix deadline Sep 14, 2026)
- What to do
- Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpapercut.comgithub.com
Aug 3, 2026PaperCut NG/MF contains an observable timing discrepancy in its authentication component.CVE-2026-8794 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.9
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2026PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component.CVE-2026-8793 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.9
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4).CVE-2026-6418 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 4.6
An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configure a source path for account data synchronization. Due to a lack of proper path validation and sanitization, an authenticated user with administrative privileges can specify arbitrary file paths on the local file system. This allows for the enumeration of directory structures and the unauthorized reading of sensitive text-based configuration or system files. When the synchronization process is triggered, the application attempts to parse the contents of the specified file, subsequently exposing the data within the application's account management interface. This vulnerability could lead to the disclosure of sensitive system information or configuration details, depending on the permissions of the service account under which the application is running.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices.CVE-2026-6180 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 4.1
A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices. Under specific network conditions involving dropped packets and out-of-order sequence counters, the server may incorrectly process fragmented data chunks. If a sequence reset notification fails to reach the server, the server may reject the initial data chunk while erroneously accepting subsequent chunks before a connection reset completes. This leads to the registration of a truncated badge ID string. While this typically results in an authentication failure, the vulnerability is compounded in environments utilizing custom badge-ID post-processing scripts. In such configurations, the truncated string may be transformed into a valid ID belonging to a different user, leading to unauthorized session establishment (Incorrect User Login) on the device.
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking.CVE-2026-5115 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Low 3.6
The PaperCut NG/MF (specifically, the embedded application for Konica Minolta devices) is vulnerable to session hijacking. The PaperCut NG/MF Embedded application is a software interface that runs directly on the touch screen of a multi-function device. It was internally discovered that the communication channel between the embedded application and the server was insecure, which could leak data including sensitive information that may be used to mount an attack on the device. Such an attack could potentially be used to steal data or to perform a phishing attack on the end user.
- Product
- Papercut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2026Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HCVE-2026-4794 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Low 2.1
Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires an active login session).
- Product
- PaperCut NG/MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management.CVE-2025-9785 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4High 7.7
PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-signed certificate. If the customer does not fully configure the system to leverage the trust database on the clients, it opens up the communication between clients and the server to man-in-the-middle attacks. It was discovered that certain parts of the documentation related to the configuration of SSL in Print Deploy were lacking, which could potentially contribute to a misconfiguration of the Print Deploy client installation. PaperCut strongly recommends to use valid certificates to secure installations and to follow the updated documentation to ensure the correct SSL configuration. Those who use private CAs and/or self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of their operating system and to the Java key store
- Product
- Print Deploy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF.CVE-2024-9672 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.3
A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur.
- Product
- PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled.CVE-2024-8405 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.1
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can be used to flood disk space and result in a Denial of Service (DoS) attack. Note: This CVE has been split from CVE-2024-4712.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.CVE-2024-8404 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4High 7.8
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server via the web-print-hot-folder. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log into the local console of the Windows environment hosting the PaperCut NG/MF application server. Update: This CVE has been updated in May 2025 to update the fixed version and fix process. Please refer to the May 2025 Security Bulletin. Note: This CVE has been split from CVE-2024-3037.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
May 14, 2024An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled.CVE-2024-4712 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4High 7.8
An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the image-handler process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can lead to local privilege escalation. Note: This CVE has been split into two (CVE-2024-4712 and CVE-2024-8405) and it’s been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
May 14, 2024An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled.CVE-2024-3037 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4High 7.8
An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server. Important: In most installations, this risk is mitigated by the default Windows Server configuration, which typically restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log in to the local console of the Windows environment hosting the PaperCut NG/MF application server. Note: This CVE has been split into two separate CVEs (CVE-2024-3037 and CVE-2024-8404) and it’s been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard users on the host server.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
Mar 14, 2024This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side applicatiCVE-2024-1884 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.5
This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
Mar 14, 2024This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server.CVE-2024-1883 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Medium 6.3
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it could potentially lead to limited loss of confidentiality, integrity or availability.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
Mar 13, 2024This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint.CVE-2024-1221 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Low 3.1
This vulnerability potentially allows files on a PaperCut NG/MF server to be exposed using a specifically formed payload against the impacted API endpoint. The attacker must carry out some reconnaissance to gain knowledge of a system token. This CVE only affects Linux and macOS PaperCut NG/MF servers.
- Product
- PaperCut NG, PaperCut MF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpapercut.compapercut.com
Jun 20, 2023PaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityCVE-2023-2533 · Other software · PaperCut · reported by help@fluidattacks.comExploitedHigh 8.4
PaperCut NG/MF contains a cross-site request forgery (CSRF) vulnerability, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code.
- Product
- NG/MF
- On CISA’s list since
- Jul 28, 2025 (federal fix deadline Aug 18, 2025)
- What to do
- Attackers are using this now. Install PaperCut’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogfluidattacks.compapercut.com
Apr 20, 2023PaperCut NG/MF Improper Authentication VulnerabilityCVE-2023-27351 · Other software · PaperCut · reported by zdi-disclosures@trendmicro.comExploitedRansomwareHigh 7.5
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
- Product
- NG/MF
- On CISA’s list since
- Apr 20, 2026 (federal fix deadline May 4, 2026)
- What to do
- Attackers are using this now. Install PaperCut’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpapercut.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.