cups has Authentication bypass with AuthType Negotiate

OpenPrinting CUPS: Local print admin token disclosure using temporary printers

OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code…

OpenPrinting CUPS vulnerable to stack based out-of-bound write

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems

A logic issue was addressed with improved state management

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management

OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)

cups: Remote DoS via null dereference

OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup

CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer

CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been…

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs()

OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack

OpenPrinting CUPS is an open source printing system

OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users

OpenPrinting CUPS: root-side banner file disclosure

OpenPrinting CUPS: Heap overflow in `get_options()`

CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)