PN
Product
Papercut NG/MF
On CISA KEVExploited in the wild
10
CVEs
1
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 5Low 0
Watch
Add Papercut NG/MF to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-2533 In wildKEV | 8.8 | Jun 20 | PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF Affected: 22.0.10 before 2.1.1 |
| CVE-2026-6180 | 8.1 | May 5 | PaperCut MF: Card truncation on HP readers Affected: before 24.1.9; before 25.0.10 |
| CVE-2026-14780 | 7.5 | Sep 24 | PaperCut NG/MF: Remote Code Execution via Scripting Subsystem Affected: before 24.1.11; 25.0.0 before 25.0.12; 26.0.0 before 26.0.2 |
| CVE-2026-5115 | 7.5 | Mar 31 | Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices Affected: before 25.0.5; before 25.0.9 (KM certified) |
| CVE-2026-82077 | 7.3 | Sep 24 | PaperCut NG/MF: Remote Code Execution via Scan2Fax Affected: before 24.1.10; 25.0.0 before 25.0.13; 26.0.0 before 26.0.5 |
| CVE-2026-87739 | 6.9 | Sep 24 | PaperCut MF/NG: User permissions are not evaluated on report generation Affected: before 24.1.10; 25.0.0 before 25.0.13; 26.0.0 before 26.0.5 |
| CVE-2026-8794 | 6.9 | Aug 3 | PaperCut NG/MF: User enumeration via timing attack Affected: before 26.0.3 |
| CVE-2026-8793 | 6.9 | Aug 3 | PaperCut NG/MF: Insufficient brute-force protection Affected: before 26.0.3 |
| CVE-2026-6418 | 4.9 | May 5 | PaperCut NG/MF: Path Traversal in Shared Account Synchronization Affected: before 25.0.11 |
| CVE-2026-4794 | 4.8 | Mar 31 | Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF Affected: before 25.0.10 |
Showing 10