Skip to content
Snipeitapp Snipe-it vulnerabilities
-
grokability snipe-it
Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
CVE-2026-116201
8.7 High
-
grokability snipe-it
Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
CVE-2026-116200
8.2 High
-
grokability snipe-it
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
CVE-2026-116199
9.2 Critical
-
grokability snipe-it
Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
CVE-2026-116198
5.3 Medium
-
grokability snipe-it
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
CVE-2026-62368
Fix available
8.1 High
-
grokability snipe-it
Snipe-IT: 2FA bypass via the API token flow
CVE-2026-63493
Fix available
8.6 High
-
grokability snipe-it
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
CVE-2026-63498
Fix available
8.7 High
-
grokability snipe-it
Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
CVE-2026-88894
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
CVE-2026-86774
5.3 Medium
-
grokability snipe-it
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
CVE-2026-86773
5.3 Medium
-
grokability snipe-it
Snipe-IT 8.6.3 Stored XSS via Department Names
CVE-2026-86772
5.1 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
CVE-2026-86771
8.3 High
-
grokability snipe-it
Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
CVE-2026-86770
8.6 High
-
grokability snipe-it
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
CVE-2026-86769
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
CVE-2026-86768
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
CVE-2026-86767
5.3 Medium
-
grokability snipe-it
Snipe-IT 8.6.3 Race Condition via Consumable Checkout
CVE-2026-86766
7.1 High
-
grokability snipe-it
Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
CVE-2026-86765
7.1 High
-
grokability snipe-it
Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
CVE-2026-86764
7.1 High
-
grokability snipe-it
snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
CVE-2026-86763
5.1 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
CVE-2026-86762
8.6 High
-
grokability snipe-it
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
CVE-2026-86761
5.3 Medium
-
grokability snipe-it
snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag
CVE-2026-86760
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
CVE-2026-86759
7.1 High
-
grokability snipe-it
Snipe-IT before 8.7.0 License Key Exposure via CSV Export
CVE-2026-86758
7.1 High
-
grokability snipe-it
Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
CVE-2026-86757
7.1 High
-
grokability snipe-it
Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
CVE-2026-86756
5.3 Medium
-
grokability snipe-it
Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth
CVE-2026-86755
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
CVE-2026-86754
8.5 High
-
grokability snipe-it
snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
CVE-2026-86753
5.3 Medium
-
grokability snipe-it
snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints
CVE-2026-86752
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
CVE-2026-86751
8.4 High
-
grokability snipe-it
snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
CVE-2026-86750
8.3 High
-
grokability snipe-it
snipe-it before 8.7.0 Data Loss via Failed Image Write
CVE-2026-86749
7.0 High
-
grokability snipe-it
Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive
CVE-2026-86748
6.9 Medium
-
grokability snipe-it
snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User
CVE-2026-86747
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay
CVE-2026-86746
7.4 High
-
grokability snipe-it
Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
CVE-2026-86745
5.1 Medium
-
grokability snipe-it
snipe-it before 8.7.0 Race Condition in Asset Checkout
CVE-2026-86744
2.1 Low
-
grokability snipe-it
Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
CVE-2026-86743
5.3 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
CVE-2026-86742
5.1 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
CVE-2026-86741
8.4 High
-
grokability snipe-it
Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
CVE-2026-86740
5.1 Medium
-
grokability snipe-it
Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
CVE-2026-86739
2.3 Low
-
grokability snipe-it
Snipe-IT before 8.7.0 CSS Injection via Custom CSS
CVE-2026-86738
9.3 Critical
-
grokability snipe-it
snipe-it before 8.7.0 Missing Authorization via barcode endpoint
CVE-2026-86737
5.3 Medium
-
grokability snipe-it
snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
CVE-2026-86736
5.3 Medium
-
grokability snipe-it
snipe-it before 8.7.0 SSRF via IPv6 transition address bypass
CVE-2026-86735
5.9 Medium
-
grokability snipe-it
Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
CVE-2026-86734
7.1 High
-
grokability snipe-it
Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
CVE-2026-86733
8.6 High
- Show olderLoading…