https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-61702.htmlhttps://patchthecve.com/cve/CVE-2026-61702.htmlTue, 20 Oct 2026 19:08:42 +0000MEDIUM 5.3: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets bannhttps://patchthecve.com/cve/CVE-2026-55480.htmlhttps://patchthecve.com/cve/CVE-2026-55480.htmlTue, 20 Oct 2026 19:37:33 +0000MEDIUM 5.7: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploihttps://patchthecve.com/cve/CVE-2026-55467.htmlhttps://patchthecve.com/cve/CVE-2026-55467.htmlTue, 20 Oct 2026 19:37:48 +0000LOW 2.5: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefixhttps://patchthecve.com/cve/CVE-2026-55453.htmlhttps://patchthecve.com/cve/CVE-2026-55453.htmlTue, 20 Oct 2026 19:38:09 +0000LOW 3.3: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to thhttps://patchthecve.com/cve/CVE-2026-107890.htmlhttps://patchthecve.com/cve/CVE-2026-107890.htmlTue, 20 Oct 2026 20:53:19 +0000LOW 3.3: OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() shttps://patchthecve.com/cve/CVE-2026-107888.htmlhttps://patchthecve.com/cve/CVE-2026-107888.htmlTue, 20 Oct 2026 20:55:06 +0000MEDIUM 5.1: OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler derehttps://patchthecve.com/cve/CVE-2026-107886.htmlhttps://patchthecve.com/cve/CVE-2026-107886.htmlTue, 20 Oct 2026 20:56:33 +0000LOW 2.3: OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-https://patchthecve.com/cve/CVE-2026-107885.htmlhttps://patchthecve.com/cve/CVE-2026-107885.htmlTue, 20 Oct 2026 20:58:50 +0000LOW 3.3: OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connechttps://patchthecve.com/cve/CVE-2026-41079.htmlhttps://patchthecve.com/cve/CVE-2026-41079.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.3: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is chttps://patchthecve.com/cve/CVE-2026-39316.htmlhttps://patchthecve.com/cve/CVE-2026-39316.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 4.0: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printehttps://patchthecve.com/cve/CVE-2026-39314.htmlhttps://patchthecve.com/cve/CVE-2026-39314.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.0: OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative j