Medium
CVE-2026-35163
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 24
Reset filters
High
CVE-2026-54134
OctoPrint has possible file exfiltration via query parameters on upload endpoints
Medium
CVE-2026-23892
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
Medium
CVE-2025-64187
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt
High
CVE-2025-58180
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
Medium
CVE-2025-48067
OctoPrint vulnerable to possible file extraction via upload endpoints
Medium
CVE-2025-48879
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
Low
CVE-2022-2822
OctoPrint does not have rate limiting on the login page
Medium
CVE-2025-32788
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
Medium
CVE-2024-51493
OctoPrint has API key access in settings without reauthentication
Medium
CVE-2024-49377
OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates
Critical
CVE-2024-32977
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely
Medium
CVE-2024-28237
XSS via the "Snapshot Test" feature in Classic Webcam plugin settings
Medium
CVE-2024-23637
OctoPrint Unverified Password Change via Access Control Settings
High
CVE-2023-41047
OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
Medium
CVE-2022-3607
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
Low
CVE-2022-2872
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
High
CVE-2022-3068
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
Medium
CVE-2022-2888
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
High
CVE-2022-2930
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
High
CVE-2021-32560
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.
Medium
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.
High
CVE-2022-1432
Cross-site Scripting in OctoPrint
High
CVE-2022-1430
Cross-site Scripting in OctoPrint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.