Hp
1807 CVEs across 17277 Hp products. Browse Hp vulnerabilities, severities, and proof-of-concept exploits.
Hp products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8632 | High | 7.8 | 2026-05-20 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of priv… |
CVE-2026-8631 | Critical | 9.8 | 2026-05-20 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of priv… |
CVE-2026-3291 | Medium | 5.5 | 2026-05-06 | Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devic… |
CVE-2026-2915 | High | 7.1 | 2026-03-03 | HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP S… |
CVE-2026-1997 | Medium | 5.3 | 2026-02-10 | Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origin… |
CVE-2026-1996 | Medium | 5.3 | 2026-02-10 | Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection. |
CVE-2025-14432 | Medium | 4.9 | 2025-12-16 | In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes… |
CVE-2025-11531 | High | 8.8 | 2025-12-09 | HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerabil… |
CVE-2025-13492 | High | 7.0 | 2025-12-03 | A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially al… |
CVE-2025-12785 | High | 7.5 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-12784 | Medium | 4.9 | 2025-11-13 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/o… |
CVE-2025-11761 | High | 7.8 | 2025-11-03 | A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during th… |
CVE-2025-43017 | Critical | 9.8 | 2025-10-28 | HP ThinPro 8.1 System management application failed to verify user's true id. HP has released HP ThinPro 8.1 SP8, which includes updates to mitigate potential… |
CVE-2025-43024 | High | 7.5 | 2025-10-28 | A GUI dialog of an application allows to view what files are in the file system without proper authorization. |
CVE-2025-10578 | High | 7.8 | 2025-10-01 | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a… |
CVE-2025-43491 | Critical | 9.8 | 2025-09-09 | A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM le… |
CVE-2025-33142 | Medium | 5.3 | 2025-08-14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. |
CVE-2025-43018 | Medium | 5.3 | 2025-07-30 | Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book. |
CVE-2025-43023 | Critical | 9.1 | 2025-07-28 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the… |
CVE-2025-3508 | Medium | 6.5 | 2025-07-25 | Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print… |
CVE-2025-43489 | Medium | 5.2 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could deserialize untrusted… |
CVE-2025-43488 | Medium | 4.8 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a bypass of the… |
CVE-2025-43487 | Medium | 6.8 | 2025-07-23 | A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The firmware flaw do… |
CVE-2025-43486 | Medium | 4.8 | 2025-07-23 | A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website allows user in… |
CVE-2025-43485 | Medium | 4.5 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a p… |
CVE-2025-43484 | Medium | 6.1 | 2025-07-23 | A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not va… |
CVE-2025-43483 | Medium | 5.7 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the retrieval o… |
CVE-2025-43022 | High | 7.2 | 2025-07-22 | A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow a privileg… |
CVE-2025-43021 | Medium | 5.7 | 2025-07-22 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and ret… |
CVE-2025-43020 | Medium | 6.8 | 2025-07-22 | A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a priv… |
CVE-2025-43019 | High | 7.8 | 2025-07-08 | A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file… |
CVE-2025-43025 | High | 7.5 | 2025-07-02 | HP Universal Print Driver is potentially vulnerable to denial of service due to buffer overflow in versions of UPD 7.4 or older (e.g., v7.3.x, v7.2.x, v7.1.x… |
CVE-2025-36038 | Critical | 9.0 | 2025-06-25 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of seriali… |
CVE-2025-43026 | High | 7.8 | 2025-06-05 | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.44.18.0. The vulnerability could potentially allow a… |
CVE-2025-33104 | Medium | 4.4 | 2025-05-14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2025-27907 | Medium | 4.1 | 2025-04-22 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized… |
CVE-2025-1697 | High | 7.8 | 2025-04-18 | A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This… |
CVE-2025-2268 | High | 7.5 | 2025-03-14 | The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Prin… |
CVE-2025-26508 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26507 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-26506 | Critical | 9.8 | 2025-02-14 | Certain HP LaserJet Pro, HP LaserJet Enterprise, and HP LaserJet Managed Printers may potentially be vulnerable to Remote Code Execution and Elevation of Privi… |
CVE-2025-1004 | Medium | 5.3 | 2025-02-06 | Certain HP LaserJet Pro printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer via IPP (Internet Printing Pro… |
CVE-2024-38320 | Medium | 5.9 | 2025-01-27 | IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than ex… |
CVE-2020-6923 | Medium | 5.7 | 2024-12-19 | The HP Linux Imaging and Printing (HPLIP) software may potentially be affected by memory buffer overflow. |
CVE-2023-30443 | Medium | 5.3 | 2024-12-19 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. |
CVE-2024-9579 | High | 7.5 | 2024-11-05 | A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation… |
CVE-2024-9419 | High | 7.8 | 2024-10-30 | Client / Server PCs with the HP Smart Universal Printing Driver installed are potentially vulnerable to Remote Code Execution and/or Elevation of Privilege. A… |
CVE-2024-45072 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-45071 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaS… |
CVE-2024-5749 | High | 7.5 | 2024-10-15 | Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials. |
CVE-2024-9423 | Medium | 5.3 | 2024-10-02 | Certain HP LaserJet printers may potentially experience a denial of service when a user sends a raw JPEG file to the printer. The printer displays a “JPEG Unsu… |
CVE-2024-45073 | Medium | 4.8 | 2024-09-30 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaS… |
CVE-2024-7720 | Critical | 9.8 | 2024-08-27 | HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries. |
CVE-2024-8105 | Medium | 6.4 | 2024-08-26 | A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK privat… |
CVE-2024-41912 | Critical | 9.8 | 2024-08-07 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access con… |
CVE-2024-42400 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42399 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42398 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these v… |
CVE-2024-42397 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42396 | Medium | 5.3 | 2024-08-06 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Certificate Management daemon accessed via the PAPI protocol. Successful explo… |
CVE-2024-42395 | Critical | 9.8 | 2024-08-06 | There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploit… |
CVE-2024-42394 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-42393 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-41913 | High | 8.8 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input. |
CVE-2024-41911 | Medium | 5.4 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web… |
CVE-2024-41910 | Medium | 6.1 | 2024-08-06 | A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS vulnerabilities in… |
CVE-2024-22442 | Critical | 9.8 | 2024-07-16 | The vulnerability could be remotely exploited to bypass authentication. |
CVE-2022-27540 | High | 7.8 | 2024-06-28 | A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code… |
CVE-2024-6147 | High | 7.8 | 2024-06-20 | Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected inst… |
CVE-2022-37020 | Medium | 6.8 | 2024-06-10 | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP… |
CVE-2022-37019 | Medium | 6.8 | 2024-06-10 | Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP i… |
CVE-2024-5143 | Medium | 6.8 | 2024-05-23 | A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By re… |
CVE-2024-2301 | High | 7.6 | 2024-05-23 | Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device. |
CVE-2024-31483 | Medium | 4.9 | 2024-05-14 | An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulne… |
CVE-2024-31482 | Medium | 5.3 | 2024-05-14 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this… |
CVE-2024-31481 | Medium | 5.3 | 2024-05-14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2024-31480 | Medium | 5.3 | 2024-05-14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2024-31479 | Medium | 5.3 | 2024-05-14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of… |
CVE-2024-31478 | Medium | 5.3 | 2024-05-14 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these… |
CVE-2024-31477 | High | 7.2 | 2024-05-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2024-31476 | High | 7.2 | 2024-05-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2024-31475 | High | 8.2 | 2024-05-14 | There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful… |
CVE-2024-31474 | High | 8.2 | 2024-05-14 | There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of th… |
CVE-2024-31473 | Critical | 9.8 | 2024-05-14 | There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending speci… |
CVE-2024-31472 | Critical | 9.8 | 2024-05-14 | There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specia… |
CVE-2024-31471 | Critical | 9.8 | 2024-05-14 | There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending… |
CVE-2024-31470 | Critical | 9.8 | 2024-05-14 | There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code e… |
CVE-2024-31469 | Critical | 9.8 | 2024-05-14 | There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending… |
CVE-2024-31468 | Critical | 9.8 | 2024-05-14 | There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending… |
CVE-2024-31467 | Critical | 9.8 | 2024-05-14 | There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted p… |
CVE-2024-31466 | Critical | 9.8 | 2024-05-14 | There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted p… |
CVE-2024-27460 | Medium | 6.7 | 2024-05-14 | A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. |
CVE-2024-28893 | High | 7.7 | 2024-05-01 | Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extr… |
CVE-2024-3281 | High | 8.8 | 2024-04-09 | A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not pro… |
CVE-2024-27254 | Medium | 5.3 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 federated server is vulnerable to denial of service with a specially cra… |
CVE-2023-38729 | Medium | 6.8 | 2024-04-03 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD w… |
CVE-2024-2209 | Medium | 6.3 | 2024-03-27 | A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (F… |
CVE-2023-4063 | Medium | 5.3 | 2024-03-22 | Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request. |
CVE-2023-45177 | Medium | 5.3 | 2024-03-20 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD is vulnerable to a denial-of-service attack due to an error within the MQ clustering logic. IBM X-Force I… |
CVE-2024-1869 | High | 7.5 | 2024-03-01 | Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpo… |