Cups
135 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Cups, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Cups CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 4 |
| 2025-10 | 0 |
| 2025-11 | 3 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 8 |
| 2026-05 | 6 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 135 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical20
- High32
- Medium69
- Low14
Latest CVEs
The 15 most recently published vulnerabilities affecting Cups.
- BDU:2026-06259Уязвимость компонента ppdc.cxx сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании3.3
- BDU:2026-06258Уязвимость функции cupsArrayAddStrings сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании7.3
- BDU:2026-06252Уязвимость компонента raster-interpret.c сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании7.5
- BDU:2026-06277Уязвимость функции scan_ps сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании5.5
- BDU:2026-06267Уязвимость сервера печати CUPS, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании6.2
- BDU:2026-06216Уязвимость функции copy_stack() сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании6.6
- CVE-2026-41079OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users4.3
- CVE-2026-39316CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer4.0
- CVE-2026-39314CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`4.0
- CVE-2026-34980OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network7.5
- CVE-2026-34979OpenPrinting CUPS: Heap overflow in `get_options()`5.3
- CVE-2026-34978OpenPrinting CUPS: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (and clobbering of job.cache)6.5
- CVE-2026-34990OpenPrinting CUPS: Local print admin token disclosure using temporary printers7.8
- CVE-2026-27447OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup4.8
- CVE-2025-58436OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack5.1
Product grouping is registry-driven, with AI assist and human review. How it works