CVE-2026-23892 | Medium | 5.9 | 2026-01-27 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing a… |
CVE-2025-64187 | Medium | 4.4 | 2025-11-07 | OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arb… |
CVE-2025-58180 | High | 8.8 | 2025-09-09 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows a… |
CVE-2025-48879 | Medium | 6.5 | 2025-06-10 | OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-d… |
CVE-2025-48067 | Medium | 5.4 | 2025-06-10 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows a… |
CVE-2025-32788 | Medium | 4.3 | 2025-04-22 | OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an a… |
CVE-2024-51493 | Medium | 5.3 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows a… |
CVE-2024-49377 | Medium | 5.5 | 2024-11-05 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities… |
CVE-2024-32977 | High | 7.1 | 2024-05-14 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows a… |
CVE-2024-28237 | Medium | 4.0 | 2024-03-18 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows ma… |
CVE-2024-23637 | Medium | 4.2 | 2024-01-31 | OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change th… |
CVE-2023-41047 | Medium | 6.2 | 2023-10-09 | OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure… |
CVE-2022-3607 | Medium | 6.0 | 2022-10-19 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-3068 | High | 8.8 | 2022-09-21 | Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-2888 | Medium | 4.4 | 2022-09-21 | If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as lon… |
CVE-2022-2872 | Medium | 5.4 | 2022-09-21 | Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-2930 | High | 7.8 | 2022-08-22 | Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-2822 | High | 7.5 | 2022-08-15 | An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user an… |
CVE-2022-1432 | Medium | 6.4 | 2022-05-18 | Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. |
CVE-2022-1430 | High | 7.5 | 2022-05-18 | Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. |
CVE-2021-32561 | Medium | 6.1 | 2021-05-11 | OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. |
CVE-2021-32560 | Medium | 6.5 | 2021-05-11 | The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files. |
CVE-2018-16710 | Critical | 9.1 | 2018-09-07 | OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor d… |