c2pa vulnerabilities and fixes

Recent CVEs affecting c2pa, with upgrade or downgrade steps. 39 tracked.

c2pa has 39 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 39. Most recent: 2026-10-13. Highest priority: CVE-2026-95634 (score 46/100).

• CVE-2026-95633 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that
• CVE-2026-103294 MEDIUM 5.9 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a
• CVE-2026-100123 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a
• CVE-2026-100118 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a
• CVE-2026-100113 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-100116 MEDIUM 5.9 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a
• CVE-2026-100121 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a
• CVE-2026-100135 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-48378 MEDIUM 5.3 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-95632 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that
• CVE-2026-48377 MEDIUM 5.3 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-95634 HIGH 8.6 UPGRADE UPGRADE CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in
• CVE-2026-100124 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-100136 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an
• CVE-2026-100125 MEDIUM 5.9 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-100120 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-100117 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-100115 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Securit
• CVE-2026-100119 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-100114 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Securit
• CVE-2026-100137 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a
• CVE-2026-100122 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a
• CVE-2026-19480 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-75632 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a
• CVE-2026-75633 MEDIUM 5.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an appl
• CVE-2026-75634 MEDIUM 4.3 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-75638 MEDIUM 6.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-76194 MEDIUM 4.3 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-89277 MEDIUM 5.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an
• CVE-2026-102501 MEDIUM 5.3 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-104345 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Secur
• CVE-2026-103297 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that
• CVE-2026-102502 MEDIUM 5.3 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that
• CVE-2026-100138 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a
• CVE-2026-100139 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a
• CVE-2026-103820 MEDIUM 5.5 UPGRADE UPGRADE CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Tr
• CVE-2026-105902 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a
• CVE-2026-106627 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to a
• CVE-2026-103296 HIGH 7.5 UPGRADE UPGRADE CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that

FAQ

How do I fix c2pa vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is c2pa being exploited right now?

None of the tracked c2pa CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which c2pa CVE should I patch first?

CVE-2026-95634 currently ranks highest (46/100): CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in.

← Back to latest CVEs