PM
IT Management
PaperCut MF/NG
On CISA KEVExploited in the wildRansomware-linked
33
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 12Medium 10Low 1
Watch
Add PaperCut MF/NG to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-81578 In wildKEV | 9.8 | Aug 28 | PaperCut MF/NG: Authentication Bypass Affected: before 24.1.10; 25.0.0 before 25.0.13; 26.0.0 before 26.0.5 |
| CVE-2023-27350 RansomwareIn wildKEV | 9.8 | Apr 20 | PaperCut MF/NG Improper Access Control Vulnerability Affected: 22.0.5 (Build 63914) |
| CVE-2026-82078 In wildKEV | 9.1 | Aug 28 | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector Affected: before 24.1.10; 25.0.0 before 25.0.13; 26.0.0 before 26.0.5 |
| CVE-2024-1222 | 9.8 | Mar 14 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges Affected: before 20.1.10; 21.0.0 before 21.2.14; 22.0.0 before 22.1.5; 23.0.1 before 23.0.7 |
| CVE-2023-39143 | 9.8 | Aug 4 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files Affected: before 22.1.3 |
| CVE-2019-12135 | 9.8 | Jun 6 | An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute… Affected: through 18.3.8; 19.0.1 through 19.0.3 |
| CVE-2019-8948 | 9.8 | Feb 20 | PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163 Affected: before 18.3.6 |
Showing 7