hp has 66 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 17 in the last 90 days against 3 in the 90 before. The busiest recent month was September 2026 with 14. The median CVSS is 8.2 (high), with 20 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-269 (7) and CWE-122 (6). Most affected products: linux_imaging_and_printing (12), pc_bios (11), support_assistant (8).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 17 prev 3
Products
- linux_imaging_and_printing 12
- pc_bios 11
- support_assistant 8
- probook_440_g8_firmware 6
- w1a75a_firmware 4
- HP AC Print & Scan 3
Worst active — by depth score
CVE-2026-91097Critical· 9.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP66CVE-2022-24293Critical· 9.8Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.55CVE-2022-24292Critical· 9.8Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.55CVE-2016-5388High· 8.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment…55CVE-2026-91106Critical· 9.8HP has identified and remediated multiple externally reported vulnerabilities within HPLIP54
hp vulnerabilities
CVEs affecting hp, newest first. Open any entry for full detail, references, and exploit status.
67 CVEsRSS
CVE-2021-39300High· 8.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVE-2021-39301High· 8.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVE-2021-39299High· 8.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVE-2021-39297High· 8.8Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
CVE-2022-23456Medium· 5.5Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
CVE-2016-5388High· 8.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment…
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment…
CVE-2016-3092High· 7.5The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial…
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial…