PA
Vendor
Papermerge
6
CVEs
0
On KEV
4
New 30D
Products
PA7.5
papermerge-core
papermerge
3 CVEs0 on KEV3 new
PA7.5
Papermerge
Papermerge
2 CVEs0 on KEV1 new
DM5.4
DMS
Papermerge
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110624 | PA papermerge-core papermerge | 3.1 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all |
| CVE-2026-110623 | PA papermerge-core papermerge | 7.5 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API |
| CVE-2026-110622 | PA papermerge-core papermerge | 7.5 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints |
| CVE-2026-105314 | PA Papermerge Papermerge | 7.5 | Oct 5 | Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call |
| CVE-2025-10209 | DM DMS Papermerge | 5.4 | Sep 10 | Papermerge DMS Authorization Token improper authorization |
| CVE-2020-29456 | PA Papermerge Papermerge | 6.1 | Dec 2 | Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create… |