# cve.now: PaperCut

The newest entries naming PaperCut as an affected vendor (up to 200), of 35 in all, 5 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-11744](https://cve.now/CVE-2026-11744.md): PaperCut Hive Embedded App for Ricoh: Javascript injection (CVSS 3.8)
- [CVE-2026-87739](https://cve.now/CVE-2026-87739.md): PaperCut MF/NG: User permissions are not evaluated on report generation (CVSS 6.9)
- [CVE-2026-82077](https://cve.now/CVE-2026-82077.md): PaperCut NG/MF: Remote Code Execution via Scan2Fax (CVSS 7.3)
- [CVE-2026-14780](https://cve.now/CVE-2026-14780.md): PaperCut NG/MF: Remote Code Execution via Scripting Subsystem (CVSS 7.5)
- [CVE-2026-82078](https://cve.now/CVE-2026-82078.md): PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector (CVSS 9.4, KEV)
- [CVE-2026-81578](https://cve.now/CVE-2026-81578.md): PaperCut MF/NG: Authentication Bypass (CVSS 8.8, KEV)
- [CVE-2026-8794](https://cve.now/CVE-2026-8794.md): PaperCut NG/MF: User enumeration via timing attack (CVSS 6.9)
- [CVE-2026-8793](https://cve.now/CVE-2026-8793.md): PaperCut NG/MF: Insufficient brute-force protection (CVSS 6.9)
- [CVE-2026-6645](https://cve.now/CVE-2026-6645.md): Insecure Search Path Vulnerability in PaperCut Print Deploy Client for Windows (CVSS 7.3)
- [CVE-2026-7824](https://cve.now/CVE-2026-7824.md): PaperCut Hive (Ricoh): Plain text password in logs (CVSS 5.9)
- [CVE-2026-6418](https://cve.now/CVE-2026-6418.md): PaperCut NG/MF: Path Traversal in Shared Account Synchronization (CVSS 4.6)
- [CVE-2026-6180](https://cve.now/CVE-2026-6180.md): PaperCut MF: Card truncation on HP readers (CVSS 4.1)
- [CVE-2026-5115](https://cve.now/CVE-2026-5115.md): Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices (CVSS 3.6)
- [CVE-2026-4794](https://cve.now/CVE-2026-4794.md): Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF (CVSS 2.1)
- [CVE-2025-9785](https://cve.now/CVE-2025-9785.md): Misconfigured certificate validation with self-signed certificates for Print Deploy (CVSS 7.7)
- [CVE-2024-9672](https://cve.now/CVE-2024-9672.md): Reflected XSS in PaperCut MF (CVSS 6.3)
- [CVE-2023-39470](https://cve.now/CVE-2023-39470.md): PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2024-8404](https://cve.now/CVE-2024-8404.md): Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder (CVSS 7.8)
- [CVE-2024-8405](https://cve.now/CVE-2024-8405.md): Arbitrary File Creation in PaperCut NG/MF Web Print leading to a Denial of Service attack (CVSS 6.1)
- [CVE-2024-4712](https://cve.now/CVE-2024-4712.md): Arbitrary File Creation in PaperCut NG/MF Web Print Image Handler (CVSS 7.8)
- [CVE-2024-3037](https://cve.now/CVE-2024-3037.md): Arbitrary File Deletion in PaperCut NG/MF Web Print (CVSS 7.8)
- [CVE-2023-39469](https://cve.now/CVE-2023-39469.md): PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability (CVSS 7.2)
- [CVE-2024-1884](https://cve.now/CVE-2024-1884.md): Server Side Request Forgery in PaperCut NG/MF (CVSS 6.5)
- [CVE-2024-1883](https://cve.now/CVE-2024-1883.md): Reflected XSS in PaperCut NG/MF (CVSS 6.3)
- [CVE-2024-1882](https://cve.now/CVE-2024-1882.md): Server-side resource injection in PaperCut NG/MF (CVSS 7.2)
- [CVE-2024-1654](https://cve.now/CVE-2024-1654.md): Unauthorized write operations in PaperCut NG/MF (CVSS 7.2)
- [CVE-2024-1223](https://cve.now/CVE-2024-1223.md): Improper authorization controls in PaperCut NG/MF (CVSS 4.8)
- [CVE-2024-1222](https://cve.now/CVE-2024-1222.md): Incorrect authorization controls in PaperCut NG/MF APIs (CVSS 8.6)
- [CVE-2024-1221](https://cve.now/CVE-2024-1221.md): Improper access controls on APIs on Linux and macOS in PaperCut NG/MF (CVSS 3.1)
- [CVE-2023-6006](https://cve.now/CVE-2023-6006.md): Privilege Escalation Vulnerability (CVSS 7.8)
- [CVE-2023-4568](https://cve.now/CVE-2023-4568.md): PaperCut NG Unauthenticated XMLRPC (CVSS 6.5)
- [CVE-2023-3486](https://cve.now/CVE-2023-3486.md): PaperCut NG Unauthenticated File Upload (CVSS 8.2)
- [CVE-2023-2533](https://cve.now/CVE-2023-2533.md): PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF (CVSS 8.4, KEV)
- [CVE-2023-27351](https://cve.now/CVE-2023-27351.md): This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). (CVSS 8.2, KEV)
- [CVE-2023-27350](https://cve.now/CVE-2023-27350.md): This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). (CVSS 9.8, KEV)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/papercut
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.