HP vulnerabilities
We track 168 vulnerabilities in HP products across 60+ products. 168 are rated high or critical, and 7 have been exploited in real attacks. The most recent was published on October 23, 2026.
Latest HP vulnerabilities
- 7.0 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.5 High severity
HP Enterprise LaserJet and HP LaserJet Managed…: Observable Discrepancy
Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to information disclosure when IPsec is enabled with FutureSmart version 5.6.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
- 8.8 High severity
Aruba Access Points running InstantOS and…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underl
- 8.8 High severity
Aruba Access Points running InstantOS and…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underl
- 8.8 High severity
Aruba Access Points running InstantOS and…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underl
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 7.0 High severity
HP PC products using AMI UEFI Firmware: Time-of-check Time-of-use (TOCTOU) Race Condition
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released upda
- 9.0 Critical severity
Deskjet 2540 A9u23b Firmware: Improper Neutralization of Input During Web Page Generation
**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows authenticated attacker to inject their own script into the page via HTTP configuration page. NOTE: T
- 7.8 High severity
HPSFViewer: Improper Privilege Management
HPSFViewer might allow Escalation of Privilege. This potential vulnerability was remediated on July 29th, 2022. Customers who opted for automatic updates should have already received the remediation.
- 7.0 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the pot
- 7.8 High severity
HP PC BIOS: Improper Control of Generation of Code
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these pote
- 7.8 High severity
HP Support Assistant: Improper Privilege Management
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
- 7.8 High severity
HP Support Assistant: Incorrect Default Permissions
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
- 7.8 High severity
HP Support Assistant: Incorrect Default Permissions
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
- 8.8 High severity
HP Security Manager: Improper Privilege Management
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
- 8.8 High severity
HP Security Manager: Improper Privilege Management
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
- 8.8 High severity
HP Security Manager: Improper Privilege Management
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
- 8.8 High severity
HP Security Manager: Improper Privilege Management
Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclosure.
- 7.5 High severity
HPE OfficeConnect 1820 and 1850 Switch Series: Improper Limitation of a Pathname to a Restricted Directory
A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allow remote directory traversal in HPE OfficeConnect 1820 switch series version PT.02.17 and below, HPE
- 7.8 High severity
HP Support Assistant: Uncontrolled Search Path Element
HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the
- 8.4 High severity
HP PC BIOS: Incorrect Default Permissions
A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerability.
- 7.8 High severity
HP Jumpstart: Incorrect Default Permissions
A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that customers uninstall HP Jumpstart and use myHP software.
- 7.8 High severity
NetBatch-Plus software: Improper Authentication
A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security Bulletin HPESBNS04388 for details.
- 9.8 Critical severity
HPE OneView: Server-Side Request Forgery
A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.