Browse CVEs

MEDIUM 6.5 CVE-2026-55469 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path t… Snipe It 8.6.2+ Fix from $1,6002026-07-10 MEDIUM 5.7 CVE-2026-55475 Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid A… Snipe It 8.6.1+ Fix from $1,6002026-07-10 MEDIUM 5.0 CVE-2026-55515 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and dele… Snipe It 8.6.2+ Fix from $1,6002026-07-10 HIGH 8.7 CVE-2026-55466 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml … Snipe It 8.6.2+ Fix from $1,9502026-07-10 HIGH 7.3 CVE-2026-55452 Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController:… Snipe It 8.5.0+ Fix from $1,9502026-07-10 MEDIUM 6.1 CVE-2026-55461 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer h… Snipe It 8.6.2+ Fix from $1,6002026-07-10 MEDIUM 6.5 CVE-2026-55843 Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through Normal… Snipe It 8.6.0+ Fix from $1,6002026-07-10 HIGH 7.7 CVE-2026-55516 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current ma… Snipe It 8.6.2+ Fix from $1,9502026-07-10 MEDIUM 6.5 CVE-2026-55474 Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a p… Snipe It 8.5.0+ Fix from $1,6002026-07-10 MEDIUM 5.4 CVE-2026-55478 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but do… Snipe It 8.6.2+ Fix from $1,6002026-07-10 HIGH 7.7 CVE-2026-54329 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory m… Snipe It 8.6.2+ Fix from $1,9502026-07-10 HIGH 7.1 CVE-2026-55460 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.d… Snipe It 8.6.2+ Fix from $1,9502026-07-10 MEDIUM 5.4 CVE-2026-55464 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyp… Snipe It 8.6.2+ Fix from $1,6002026-07-10 MEDIUM 6.5 CVE-2026-48492 Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorizati… Snipe It 8.6.0+ Fix from $1,6002026-07-08 MEDIUM 5.5 CVE-2026-48493 Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_o… Snipe It 8.6.0+ Fix from $1,6002026-06-23 HIGH 7.1 CVE-2026-48507 Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `user… Snipe It 8.6.0+ Fix from $1,9502026-06-08 HIGH 8.8 CVE-2026-44832 Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own priv… Snipe It 8.4.1+ Fix from $1,9502026-05-26 HIGH 7.1 CVE-2026-44833 Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to m… Snipe It 8.4.1+ Fix from $1,9502026-05-26 MEDIUM 5.4 CVE-2026-44831 Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, r… Snipe It 8.4.1+ Fix from $1,6002026-05-26 CRITICAL 9.8 CVE-2026-37709 Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to … Snipe It 8.4.1+ Fix from $2,3002026-05-07 MEDIUM 6.5 CVE-2026-38533 An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit perm… Snipe It No fix yet Fix from $1,6002026-04-14 HIGH 8.8 CVE-2025-15602 Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assig… Snipe It 8.3.7+ Fix from $1,9502026-03-06 MEDIUM 5.4 CVE-2025-65622 Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that exe… Snipe It 8.3.4+ Fix from $1,6002025-12-01 MEDIUM 5.4 CVE-2025-65621 Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's sessio… Snipe It 8.3.4+ Fix from $1,6002025-12-01 MEDIUM 6.1 CVE-2025-64027 Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is u… Snipe It No fix yet Fix from $1,6002025-11-20 CRITICAL 9.9 CVE-2025-63601 Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file … Snipe It 8.3.3+ Fix from $2,3002025-11-05 HIGH 8.1 CVE-2025-59713 Snipe-IT before 8.1.18 allows unsafe deserialization. Snipe It 8.1.18+ Fix from $1,9502025-09-19 MEDIUM 5.4 CVE-2025-59712 Snipe-IT before 8.1.18 allows XSS. Snipe It 8.1.18+ Fix from $1,6002025-09-19 HIGH 8.7 CVE-2024-51093 Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. T… Snipe It Mitigation only Fix from $1,9502024-11-12 HIGH 8.0 CVE-2024-51094 An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name… Snipe It Mitigation only Fix from $1,9502024-11-12