OC
Product
OctoPrint
27
CVEs
0
On KEV
9.4
Max CVSS
2
New 30D
Severity mix
Critical 2High 7Medium 18Low 0
Watch
Add OctoPrint to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-32977 | 9.4 | May 14 | OctoPrint provides a web interface for controlling consumer 3D printers Affected: before 1.10.1 |
| CVE-2018-16710 | 9.1 | Sep 7 | OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081 Affected: through 1.3.9 |
| CVE-2025-58180 | 8.8 | Sep 9 | OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload Affected: < 1.11.3 |
| CVE-2022-3068 | 8.8 | Sep 21 | Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3 Affected: before 1.8.3 |
| CVE-2022-2930 | 7.8 | Aug 22 | Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3 Affected: before 1.8.3 |
| CVE-2022-2822 | 7.5 | Aug 15 | An attacker can freely brute force username and password and can takeover any account Affected: before 1.9.0 |
| CVE-2022-1430 | 7.5 | May 18 | Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0 Affected: before 1.8.0 |
| CVE-2014-125135 New | 7.3 | Oct 26 | OctoPrint Flask Secret Key hard-coded key Affected: 1.0.0; 1.1.0 |
| CVE-2026-54134 | 7.0 | Aug 21 | OctoPrint: File exfiltration possible via query parameters on upload endpoints Affected: < 1.11.8; >= 2.0.0rc1, < 2.0.0rc3 |
| CVE-2025-48879 | 6.5 | Jun 10 | OctoPrint Vulnerable to Denial of Service through malformed HTTP request Affected: < 1.11.2 |
| CVE-2024-51493 | 6.5 | Nov 5 | API key access in settings without reauthentication in OctoPrint Affected: < 1.10.3 |
| CVE-2023-41047 | 6.5 | Oct 9 | OctoPrint is a web interface for 3D printers Affected: before 1.9.3 |
| CVE-2021-32560 | 6.5 | May 11 | The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files Affected: before 1.6.0 |
| CVE-2022-1432 | 6.4 | May 18 | Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0 Affected: before 1.8.0 |
| CVE-2024-49377 | 6.1 | Nov 5 | Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint Affected: < 1.10.3 |
| CVE-2021-32561 | 6.1 | May 11 | OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters Affected: before 1.6.0 |
| CVE-2022-3607 | 6.0 | Oct 19 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint Affected: before 1.8.3 |
| CVE-2026-23892 | 5.9 | Jan 27 | OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication Affected: < 1.11.6 |
| CVE-2022-2872 | 5.4 | Sep 21 | Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3 Affected: before 1.8.3 |
| CVE-2013-10077 New | 5.3 | Oct 26 | OctoPrint API Key settings.py getSettings information disclosure Affected: 1.0.0 |
| CVE-2024-23637 | 4.9 | Jan 31 | OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other… Affected: through 1.9.3 |
| CVE-2024-28237 | 4.8 | Mar 18 | OctoPrint provides a web interface for controlling consumer 3D printers Affected: before 1.10.0; 1.10.0; 1.10.0 |
| CVE-2026-35163 | 4.6 | Aug 21 | OctoPrint: XSS in Suppressed Command Notifications Affected: < 1.11.8; >= 2.0.0rc1, < 2.0.0rc3 |
| CVE-2025-48067 | 4.6 | Jun 10 | OctoPrint vulnerable to possible file extraction via upload endpoints Affected: < 1.11.2 |
| CVE-2025-64187 | 4.4 | Nov 7 | OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts Affected: < 1.11.4 |
| CVE-2022-2888 | 4.4 | Sep 21 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's… Affected: before 1.8.3 |
| CVE-2025-32788 | 4.3 | Apr 22 | OctoPrint Authenticated Reverse Proxy Page Authentication Bypass Affected: < 1.11.0 |
Showing 27