CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Nov 2, 2026, 1:25 AM ET)

What this means for you

This week: 3,465 CVEs published, 269 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,465; Show in the list
Critical, last 7 days: 269; Show in the list
Healthcare-tagged, last 7 days: 2; Show in the list
Known exploited (CISA KEV): 1,765; Show in the list

Showing CVEs that name the product apple:cups. Show all products

11 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2022-26691	Medium 6.7	A logic issue was addressed with improved state management.	May 26, 2022
CVE-2010-3702	High 7.5	The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent atta…	Nov 5, 2010
CVE-2010-2941	Critical 9.8	ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-f…	Nov 5, 2010
CVE-2010-1748	Medium 4.3	The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly ha…	Jun 17, 2010
CVE-2010-0302	High 7.5	Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epol…	Mar 5, 2010
CVE-2009-3553	High 7.5	Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS 1.3.7 and 1.3.10 allows remote at…	Nov 19, 2009
CVE-2009-0949	High 7.5	The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allows remote attackers to cause a denial of service (NULL point…	Jun 9, 2009
CVE-2008-5183	High 7.5	cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL poi…	Nov 20, 2008
CVE-2008-1033	Low 2.1	The scheduler in CUPS in Apple Mac OS X 10.5 before 10.5.3, when debug logging is enabled and a printer requires a password, allows attackers to obtain sensitive information (credentials) by reading…	Jun 2, 2008
CVE-2007-3387	Medium 6.8	Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and othe…	Jul 30, 2007

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.