CVE-2026-13753

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-703

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
HP IncHP DeskJet 2820 AIO Printer< <001.2629A
HP IncHP DeskJet 2823 AIO Printer< <001.2629A
HP IncHP DeskJet 2822 AIO Printer< <001.2629A
HP IncHP DeskJet 2829 AIO Printer< <001.2629A
HP IncHP DeskJet 2821 AIO Printer< <001.2629A
HP IncHP DeskJet 2820 All-in-One Printer< <001.2629A
HP IncHP DeskJet 2828 AIO Printer< <001.2629A
HP IncHP DeskJet 2823 AIO Printer< <001.2629A
HP IncHP DeskJet 2821 AIO Printer< <001.2629A
HP IncHP DeskJet 2810 Printer< <001.2629A
HP IncHP DeskJet 2820e AIO Printer< <001.2629A
HP IncHP DeskJet 2842e All-in-One< <001.2629A
HP IncHP DeskJet 2820e AIO Printer< <001.2629A
HP IncHP DeskJet 2821e All-in-One< <001.2629A
HP IncHP DeskJet 2810e AIO Printer< <001.2629A
HP IncHP DeskJet 2821e AIO Printer< <001.2629A
HP IncHP DeskJet 2823e AIO Printer< <001.2629A
HP IncHP DeskJet 2822e AIO Printer< <001.2629A
HP IncHP DeskJet 2823e AIO Printer< <001.2629A
HP IncHP DeskJet 2842e All-in-One Printer< <001.2629A
HP IncHP DeskJet 2827e All-in-One Printer< <001.2629A
HP IncHP DeskJet 2825e All-in-One Printer< <001.2629A
HP IncHP DJ 4227e NA OOVWhite Printer< <001.2629A
HP IncHP DeskJet 2842e AIO Printer< <001.2629A
HP IncHP DeskJet 2855e AIO Printer< <001.2629A
HP IncHP DeskJet 2852e All-in-One Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2875 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2874 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2875 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2876 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2878 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2875 All-in-One< <001.2629A
HP IncHP DeskJet Ink Advantage 2875 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2879 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2878 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2876 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2877 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage 2879 Printer< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4925< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4927< <001.2629A
HP IncHP DeskJet Ink Advantage 4928 All-in-One Printer< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4925< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4926< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4977< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4929< <001.2629A
HP IncHP DeskJet Ink Advantage 4929 All-in-One Printer< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4928< <001.2629A
HP IncHP DeskJet Ink Advantage 4978 All-in-One Printer< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4975< <001.2629A
HP IncHP DeskJet Ink Advantage Ultra 4976< <001.2629A

References

Timeline

Published
Jul 6, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-137546.5The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versionsCVE-2026-137556.4The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode ACVE-2026-137568.8The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to mCVE-2026-137576.2A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_aCVE-2026-137583.7CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decCVE-2026-137598.8IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableCVE-2026-13767.5IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of rCVE-2026-137607.3OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actCVE-2026-137618.8Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially CVE-2026-137629.8Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managedCVE-2026-137639.8Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWSCVE-2026-137648.8The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,
CVE-2026-13753: High severity, CVSS 7.5 | Vulnix