CVE Tools
Track your stack

Cups

143 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Cups, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Cups CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Cups CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-094
2025-100
2025-113
2025-120
2026-010
2026-020
2026-030
2026-048
2026-056
2026-060
2026-070
2026-080
2026-090
2026-108
2026-110

Severity

How the 143 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2014%
  • High3222%
  • Medium7250%
  • Low1913%

Latest CVEs

The 15 most recently published vulnerabilities affecting Cups.

  1. CVE-2026-61702OpenPrinting CUPS: root-side banner file disclosure5.3
  2. CVE-2026-55453CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip3.3
  3. CVE-2026-55480CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)5.7
  4. CVE-2026-55467CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)2.5
  5. CVE-2026-107890OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, b...3.3
  6. CVE-2026-107888OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Tempo...5.1
  7. CVE-2026-107886OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without cle...2.3
  8. CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending job...3.3
  9. BDU:2026-06259Уязвимость компонента ppdc.cxx сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании3.3
  10. BDU:2026-06258Уязвимость функции cupsArrayAddStrings сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании7.3
  11. BDU:2026-06252Уязвимость компонента raster-interpret.c сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании7.5
  12. BDU:2026-06277Уязвимость функции scan_ps сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании5.5
  13. BDU:2026-06267Уязвимость сервера печати CUPS, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании6.2
  14. BDU:2026-06216Уязвимость функции copy_stack() сервера печати CUPS, позволяющая нарушителю вызвать отказ в обслуживании6.6
  15. CVE-2026-41079OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users4.3

Product grouping is registry-driven, with AI assist and human review. How it works