Vulnerabilidades de Hp

CVEs publicadas que afetam produtos de Hp: 95 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-5923 Média · 6.0 CWE-352 08/07/2026

Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack

Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.

CVE-2026-5922 Média · 5.9 CWE-79 08/07/2026

Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.

CVE-2026-13753 Alta · 7.5 CWE-703 06/07/2026

Certain HP DeskJet All in One – Potential Information Disclosure

Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs.

CVE-2026-2891 Alta · 8.2 CWE-400 01/07/2026

Poly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service

The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-8864 Alta · 7.3 CWE-428 30/06/2026

HP Fan Control App – Potential Escalation of Privilege

The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this potential vulnerability.

CVE-2026-7539 Alta · 7.3 CWE-379 24/06/2026

HP Dock Accessory WMI Provider Installer Security Update

A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

CVE-2026-5064 Alta · 8.5 CWE-427 15/06/2026

HP One Agent Software – Security Update

Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or denial of service. HP is releasing software updates to mitigate these potential vulnerabilities.

CVE-2026-0826 Crítica · 9.2 Exploit público CWE-121 01/06/2026

Poly Voice – Possible Remote Control of Certain Poly Devices

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

CVE-2026-8632 Alta · 7.8 CWE-77 20/05/2026

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via operating system command injection.

CVE-2026-8631 Crítica · 9.8 CWE-190 20/05/2026

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

CVE-2026-3291 Média · 5.5 CWE-926 06/05/2026

Samsung Print Service Plugin – Potential Information Disclosure

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-4682 Alta · 8.7 CWE-121 15/04/2026

Certain HP DeskJet All In One (AIO) Devices – Potential Remote Code Execution & Potential Buffer Overflow

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP. WSD Scan is a Microsoft Windows–based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

CVE-2026-4667 Alta · 7.3 CWE-250 15/04/2026

HP System Optimizer - Escalation of Privilege

HP System Optimizer might potentially be vulnerable to escalation of privilege. HP is releasing an update to mitigate this potential vulnerability.

CVE-2026-2915 Alta · 7.1 CWE-276 03/03/2026

HP System Event Utility – Denial of Service

HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was remediated with HP System Event Utility version 3.2.16.

CVE-2026-0754 Alta · 8.2 CWE-321 02/03/2026

SIP Service Providers – Possible Impersonation of Poly Voice Device

An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate.

CVE-2026-2832 Média · 5.3 CWE-200 20/02/2026

Certain Samsung MultiXpress Multifunction Printers Firmware – Potential Information Disclosure

Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing address book entries and other device configuration information through specific APIs without proper authorization.

CVE-2026-1578 Média · 5.1 CWE-79 13/02/2026

HP App – Potential Cross-Site Scripting

HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

CVE-2026-1997 Média · 5.3 CWE-346 10/02/2026

Certain HP OfficeJet Pro Printers - Information Disclosure

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

CVE-2026-1996 Média · 5.3 CWE-703 10/02/2026

Certain HP OfficeJet Pro Printers – Denial of Service

Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.

CVE-2025-14432 Média · 4.9 CWE-532 16/12/2025

Poly Video - Sensitive Data Might Be Written to Log File

In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.

CVE-2025-11531 Alta · 8.8 CWE-22 09/12/2025

HP System Event Utility and Omen Gaming Hub – Potential Arbitrary Code Execution

HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerability was remediated with HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0.

CVE-2025-13492 Alta · 7.0 CWE-363 03/12/2025

HP Image Assistant - Potential Escalation of Privilege

A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially allow a local attacker to escalate privileges via a race condition when installing packages.

CVE-2025-12785 Alta · 7.5 CWE-200 13/11/2025

Certain HP LaserJet Pro Printers – Potential Information Disclosure

Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server.

CVE-2025-12784 Média · 4.9 CWE-200 13/11/2025

Certain HP LaserJet Pro Printers – Potential Information Disclosure

Certain HP LaserJet Pro printers may be vulnerable to information disclosure leading to credential exposure by altering the scan/send destination address and/or modifying the LDAP Server.

CVE-2025-11761 Alta · 7.8 CWE-427 03/11/2025

HP Client Management Script Library – Security Update

A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.