https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-23892.htmlhttps://patchthecve.com/cve/CVE-2026-23892.htmlWed, 17 Jun 2026 10:22:16 +0000MEDIUM 5.9: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the firsthttps://patchthecve.com/cve/CVE-2025-64187.htmlhttps://patchthecve.com/cve/CVE-2025-64187.htmlWed, 17 Jun 2026 09:53:58 +0000MEDIUM 4.4: OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinhttps://patchthecve.com/cve/CVE-2025-58180.htmlhttps://patchthecve.com/cve/CVE-2025-58180.htmlMon, 19 Oct 2026 17:10:00 +0000HIGH 8.8: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename bechttps://patchthecve.com/cve/CVE-2025-48879.htmlhttps://patchthecve.com/cve/CVE-2025-48879.htmlWed, 17 Jun 2026 09:30:25 +0000MEDIUM 6.5: OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multiparthttps://patchthecve.com/cve/CVE-2025-48067.htmlhttps://patchthecve.com/cve/CVE-2025-48067.htmlWed, 17 Jun 2026 09:29:05 +0000MEDIUM 5.4: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the uploahttps://patchthecve.com/cve/CVE-2025-32788.htmlhttps://patchthecve.com/cve/CVE-2025-32788.htmlWed, 17 Jun 2026 09:12:34 +0000MEDIUM 4.3: OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential futuhttps://patchthecve.com/cve/CVE-2024-51493.htmlhttps://patchthecve.com/cve/CVE-2024-51493.htmlWed, 17 Jun 2026 08:05:47 +0000MEDIUM 5.3: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's https://patchthecve.com/cve/CVE-2024-49377.htmlhttps://patchthecve.com/cve/CVE-2024-49377.htmlWed, 17 Jun 2026 07:59:47 +0000MEDIUM 5.5: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on ahttps://patchthecve.com/cve/CVE-2024-32977.htmlhttps://patchthecve.com/cve/CVE-2024-32977.htmlWed, 17 Jun 2026 07:30:48 +0000HIGH 7.1: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if thhttps://patchthecve.com/cve/CVE-2024-28237.htmlhttps://patchthecve.com/cve/CVE-2024-28237.htmlWed, 17 Jun 2026 07:21:14 +0000MEDIUM 4.0: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "https://patchthecve.com/cve/CVE-2024-23637.htmlhttps://patchthecve.com/cve/CVE-2024-23637.htmlWed, 17 Jun 2026 07:13:16 +0000MEDIUM 4.2: OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin