Skip to contentGrokability, Inc. Snipe-it vulnerabilities
- grokability snipe-itSnipe-IT before 8.5.0 SAML Assertion Replay via Race ConditionCVE-2026-1162018.7 High
- grokability snipe-itSnipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()CVE-2026-1162008.2 High
- grokability snipe-itSnipe-IT before 8.6.3 Authentication Bypass via Google SSO CallbackCVE-2026-1161999.2 Critical
- grokability snipe-itSnipe-IT before 8.7.0 Missing Encryption via Api AssetsController storeCVE-2026-1161985.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing EndpointCVE-2026-1140645.1 Medium
- grokability snipe-itSnipe-IT: Stored XSS via Custom Field name in asset-list column headersCVE-2026-62368Fix available8.1 High
- grokability snipe-itSnipe-IT: 2FA bypass via the API token flowCVE-2026-63493Fix available8.6 High
- grokability snipe-itSnipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APICVE-2026-63498Fix available8.7 High
- grokability snipe-itSnipe-IT before 8.7.2 Authorization Bypass via Predefined Kit CheckoutCVE-2026-888945.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Broken Access Control via AssetModelPolicyCVE-2026-867745.3 Medium
- grokability snipe-itSnipe-IT 8.6.3 Broken Access Control via Kit Update EndpointsCVE-2026-867735.3 Medium
- grokability snipe-itSnipe-IT 8.6.3 Stored XSS via Department NamesCVE-2026-867725.1 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Server-Side Request Forgery via employee_numCVE-2026-867718.3 High
- grokability snipe-itSnipe-IT before 8.7.0 Authentication Bypass via SAML Username CollationCVE-2026-867708.6 High
- grokability snipe-itSnipe-IT before 8.7.0 Audit Log Misattribution via Consumables CheckoutCVE-2026-867695.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Improper Input Validation via API CheckoutCVE-2026-867685.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Cross-Company Read via requested-assetsCVE-2026-867675.3 Medium
- grokability snipe-itSnipe-IT 8.6.3 Race Condition via Consumable CheckoutCVE-2026-867667.1 High
- grokability snipe-itSnipe-IT 8.6.3 Authorization Bypass via Asset Update EndpointCVE-2026-867657.1 High
- grokability snipe-itSnipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned componentsCVE-2026-867647.1 High
- grokability snipe-itsnipe-it 7.0.12 through 8.6.3 Authorization Bypass via ImporterCVE-2026-867635.1 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Authentication Bypass via API MiddlewareCVE-2026-867628.6 High
- grokability snipe-itsnipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpointsCVE-2026-867615.3 Medium
- grokability snipe-itsnipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flagCVE-2026-867605.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Missing Authorization via asset-history CSV importerCVE-2026-867597.1 High
- grokability snipe-itSnipe-IT before 8.7.0 License Key Exposure via CSV ExportCVE-2026-867587.1 High
- grokability snipe-itSnipe-IT before 8.7.0 Information Disclosure via Custom FieldsCVE-2026-867577.1 High
- grokability snipe-itSnipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayStateCVE-2026-867565.3 Medium
- grokability snipe-itSnipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuthCVE-2026-867555.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via OAuth ClientsCVE-2026-867548.5 High
- grokability snipe-itsnipe-it before 8.7.0 Business Logic Bypass via asset_model endpointCVE-2026-867535.3 Medium
- grokability snipe-itsnipe-it before 8.7.0 Authorization Bypass via Asset Audit EndpointsCVE-2026-867525.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Arbitrary File Read and SSRF via MarkdownCVE-2026-867518.4 High
- grokability snipe-itsnipe-it before 8.7.0 Authorization Bypass via API User Create/UpdateCVE-2026-867508.3 High
- grokability snipe-itsnipe-it before 8.7.0 Data Loss via Failed Image WriteCVE-2026-867497.0 High
- grokability snipe-itSnipe-IT before 8.7.0 Database Wipe via Invalid Backup ArchiveCVE-2026-867486.9 Medium
- grokability snipe-itsnipe-it before 8.7.0 Authorization Bypass via Pivot-Only UserCVE-2026-867475.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot ReplayCVE-2026-867467.4 High
- grokability snipe-itSnipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping ExportCVE-2026-867455.1 Medium
- grokability snipe-itsnipe-it before 8.7.0 Race Condition in Asset CheckoutCVE-2026-867442.1 Low
- grokability snipe-itSnipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance ReportCVE-2026-867435.3 Medium
- grokability snipe-itSnipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance ReportCVE-2026-867425.1 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULACVE-2026-867418.4 High
- grokability snipe-itSnipe-IT before 8.7.0 Attachment Deletion Reports Success While File RemainsCVE-2026-867405.1 Medium
- grokability snipe-itSnipe-IT before 8.7.0 Acceptance Finalization Without Stored EvidenceCVE-2026-867392.3 Low
- grokability snipe-itSnipe-IT before 8.7.0 CSS Injection via Custom CSSCVE-2026-867389.3 Critical
- grokability snipe-itsnipe-it before 8.7.0 Missing Authorization via barcode endpointCVE-2026-867375.3 Medium
- grokability snipe-itsnipe-it before 8.7.0 Checkout Request Counter Integrity FailureCVE-2026-867365.3 Medium
- grokability snipe-itsnipe-it before 8.7.0 SSRF via IPv6 transition address bypassCVE-2026-867355.9 Medium
- grokability snipe-itSnipe-IT before 8.7.1 Denial of Service via Unbounded Note FieldCVE-2026-867347.1 High
- Show olderLoading…