Hp vulnerabilities

Published CVEs affecting Hp products: 76 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-106177 Medium · 6.4 CWE-122 Oct 8, 2026

HP Sure Click Kernel Buffer Overflow

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability.

CVE-2026-84900 Medium · 6.8 CWE-354 Oct 5, 2026

HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates

Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which includes updates to mitigate potential vulnerabilities. Previous versions of HP ThinPro (prior to HP ThinPro 9 SP3) could potentially contain security vulnerabilities. HP has released HP ThinPro 9 SP3, which includes updates to mitigate potential vulnerabilities.

CVE-2026-12556 High · 7.7 CWE-319 Aug 24, 2026

HP Easy Start for macOS - Security Update

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-12555 High · 7.7 CWE-379 Aug 24, 2026

HP Easy Start for macOS - Security Update

CVE-2026-12554 High · 8.5 CWE-1104 Aug 24, 2026

HP Easy Start for macOS - Security Update

CVE-2026-75946 High · 8.2 CWE-347 Aug 21, 2026

OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.

CVE-2026-5923 Medium · 6.0 CWE-352 Jul 8, 2026

Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack

Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.

CVE-2026-5922 Medium · 5.9 CWE-79 Jul 8, 2026

Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.

CVE-2026-13753 High · 7.5 CWE-703 Jul 6, 2026

Certain HP DeskJet All in One – Potential Information Disclosure

Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs.

CVE-2026-2891 High · 8.2 CWE-400 Jul 1, 2026

Poly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service

The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-8864 High · 7.3 CWE-428 Jun 30, 2026

HP Fan Control App – Potential Escalation of Privilege

The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this potential vulnerability.

CVE-2026-7539 High · 7.3 CWE-379 Jun 24, 2026

HP Dock Accessory WMI Provider Installer Security Update

A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

CVE-2026-5064 High · 8.5 CWE-427 Jun 15, 2026

HP One Agent Software – Security Update

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or denial of service. HP is releasing software updates to mitigate these potential vulnerabilities.

CVE-2026-0826 Critical · 9.2 Public exploit CWE-121 Jun 1, 2026

Poly Voice – Possible Remote Control of Certain Poly Devices

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

CVE-2026-8632 High · 7.8 CWE-77 May 20, 2026

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection.

CVE-2026-8631 Critical · 9.8 CWE-190 May 20, 2026

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

CVE-2026-3291 Medium · 5.5 CWE-926 May 6, 2026

Samsung Print Service Plugin – Potential Information Disclosure

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-4682 High · 8.7 CWE-121 Apr 15, 2026

Certain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

CVE-2026-4667 High · 7.3 CWE-250 Apr 15, 2026

HP System Optimizer - Escalation of Privilege

HP System Optimizer might potentially be vulnerable to escalation of privilege. HP is releasing an update to mitigate this potential vulnerability.

CVE-2026-2915 High · 7.1 CWE-276 Mar 3, 2026

HP System Event Utility – Denial of Service

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16.

CVE-2026-0754 High · 8.2 CWE-321 Mar 2, 2026

SIP Service Providers – Possible Impersonation of Poly Voice Device

An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.

CVE-2026-2832 Medium · 5.3 CWE-200 Feb 20, 2026

Certain Samsung MultiXpress Multifunction Printers Firmware – Potential Information Disclosure

Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing address book entries and other device configuration information through specific APIs without proper authorization.

CVE-2026-1578 Medium · 5.1 CWE-79 Feb 13, 2026

HP App – Potential Cross-Site Scripting

HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-1997 Medium · 5.3 CWE-346 Feb 10, 2026

Certain HP OfficeJet Pro Printers - Information Disclosure

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

CVE-2026-1996 Medium · 5.3 CWE-703 Feb 10, 2026

Certain HP OfficeJet Pro Printers – Denial of Service

Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.