Known vulnerabilities in OctoPrint

Software: OctoPrint
Software CPE: cpe:2.3:a:octoprint.org:octoprint:*:*:*:*:*:*:*:*
Total vulnerabilities: 21
Public exploits: 0
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting OctoPrint OctoPrint is affected by 21 known vulnerabilities: 5 medium, 16 low Critical High Medium Low

Vulnerabilities (21)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU162909 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2026-35163
CWE-80 Medium
No
No
1.11.8, 2.0.0 09.11.2026 SB20261109124
#VU162908 - External Control of File Name or Path
CVE-2026-54134
CWE-73 Low
No
No
1.11.8, 2.0.0 09.11.2026 SB20261109124
#VU162907 - Information Exposure Through Timing Discrepancy
CVE-2026-23892
CWE-208 Medium
No
No
1.11.6 09.11.2026 SB20261109123
#VU118151 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-64187
CWE-79 Low
No
No
1.11.4 06.11.2025 SB2025110618
#VU162906 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-58180
CWE-78 Medium
No
No
1.11.3 09.09.2025 SB20250909109
#VU162905 - External Control of File Name or Path
CVE-2025-48067
CWE-73 Low
No
No
1.11.2 10.06.2025 SB20250610114
#VU162904 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2025-48879
CWE-835 Medium
No
No
1.11.2 10.06.2025 SB20250610114
#VU162903 - Authentication Bypass by Spoofing
CVE-2025-32788
CWE-290 Low
No
No
1.11.0 22.04.2025 SB20250422199
#VU100038 - Missing Authentication for Critical Function
CVE-2024-51493
CWE-306 Low
No
No
1.10.3 07.11.2024 SB2024110715
#VU100036 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-49377
CWE-79 Low
No
No
1.10.3 07.11.2024 SB2024110715
#VU162900 - Authentication Bypass by Spoofing
CVE-2024-32977
CWE-290 Medium
No
No
1.10.1 14.05.2024 SB2024051471
#VU162901 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-28237
CWE-79 Low
No
No
1.10.0 18.03.2024 SB2024013170
#VU162902 - Unverified Password Change
CVE-2024-23637
CWE-620 Low
No
No
1.10.0 31.01.2024 SB2024013170
#VU81950 - Improper Control of Generation of Code ('Code Injection')
CVE-2023-41047
CWE-94 Low
No
No
1.9.3 12.10.2023 SB2023101246
#VU66690 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Low
No
No
1.8.2 22.08.2022 SB2022082217
#VU66689 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-1430
CWE-79 Low
No
No
1.8.0 22.08.2022 SB2022082216
#VU66688 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-1432
CWE-79 Low
No
No
1.8.0 22.08.2022 SB2022082216
#VU63628 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
1.8.1 25.05.2022 SB2022052505
#VU53326 - Improper Access Control
CVE-2021-32560
CWE-284 Low
No
No
1.6.0 18.05.2021 SB2021051803
#VU53323 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-32561
CWE-79 Low
No
No
1.6.0 18.05.2021 SB2021051803


Showing elements 1 - 20 out of 21