CVE-2026-88894Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout Exploitation status Public exploit Fix Published 09/10/2026 Severity Medium CVE-2026-86774Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy Exploitation status Not confirmed Fix Published 09/09/2026 Severity Medium CVE-2026-86773Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints Exploitation status Public exploit Fix Published 09/09/2026 Severity Medium CVE-2026-86772Snipe-IT 8.6.3 Stored XSS via Department Names Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86771Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num Exploitation status Public exploit Fix Published 09/09/2026 Severity High CVE-2026-86770Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86769Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout Exploitation status Not confirmed Fix Published 09/09/2026 Severity Medium CVE-2026-86768Snipe-IT before 8.7.0 Improper Input Validation via API Checkout Exploitation status Public exploit Fix Published 09/09/2026 Severity Medium CVE-2026-86767Snipe-IT before 8.7.0 Cross-Company Read via requested-assets Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86766Snipe-IT 8.6.3 Race Condition via Consumable Checkout Exploitation status Public exploit Fix Published 09/09/2026 Severity High CVE-2026-86765Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86764Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86763snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86762Snipe-IT before 8.7.0 Authentication Bypass via API Middleware Exploitation status Not known exploited Fix Published 09/09/2026 Severity High CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints Exploitation status Public exploit Fix Published 09/09/2026 Severity Medium CVE-2026-86760snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag Exploitation status Not confirmed Fix Published 09/09/2026 Severity Medium CVE-2026-86759Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86758Snipe-IT before 8.7.0 License Key Exposure via CSV Export Exploitation status Not known exploited Fix Published 09/09/2026 Severity High CVE-2026-86757Snipe-IT before 8.7.0 Information Disclosure via Custom Fields Exploitation status Not known exploited Fix Published 09/09/2026 Severity High CVE-2026-86756Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86755Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth Exploitation status Not confirmed Fix Published 09/09/2026 Severity Medium CVE-2026-86754Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86753snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86752snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86751Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown Exploitation status Public exploit Fix Published 09/09/2026 Severity High CVE-2026-86750snipe-it before 8.7.0 Authorization Bypass via API User Create/Update Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86749snipe-it before 8.7.0 Data Loss via Failed Image Write Exploitation status Not confirmed Fix Published 09/09/2026 Severity High CVE-2026-86748Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive Exploitation status Public exploit Fix Published 09/09/2026 Severity Medium CVE-2026-86747snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86746Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay Exploitation status Public exploit Fix Published 09/09/2026 Severity High CVE-2026-86745Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export Exploitation status Not confirmed Fix Published 09/09/2026 Severity Medium CVE-2026-86744snipe-it before 8.7.0 Race Condition in Asset Checkout Exploitation status Not confirmed Fix Published 09/09/2026 Severity Low CVE-2026-86743Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report Exploitation status Public exploit Fix Published 09/09/2026 Severity Medium CVE-2026-86742Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report Exploitation status Not known exploited Fix Published 09/09/2026 Severity Medium CVE-2026-86741Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA Exploitation status Public exploit Fix Published 09/09/2026 Severity High CVE-2026-86740Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains Exploitation status Not confirmed Fix Published 09/09/2026 Severity Medium CVE-2026-86739Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence Exploitation status Not confirmed Fix Published 09/09/2026 Severity Low CVE-2026-86738Snipe-IT before 8.7.0 CSS Injection via Custom CSS Exploitation status Not known exploited Fix Published 09/08/2026 Severity Critical CVE-2026-86737snipe-it before 8.7.0 Missing Authorization via barcode endpoint Exploitation status Not known exploited Fix Published 09/08/2026 Severity Medium CVE-2026-86736snipe-it before 8.7.0 Checkout Request Counter Integrity Failure Exploitation status Not confirmed Fix Published 09/08/2026 Severity Medium CVE-2026-86735snipe-it before 8.7.0 SSRF via IPv6 transition address bypass Exploitation status Not known exploited Fix Published 09/08/2026 Severity Medium CVE-2026-86734Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field Exploitation status Not known exploited Fix Published 09/08/2026 Severity High CVE-2026-86733Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore Exploitation status Not known exploited Fix Published 09/08/2026 Severity High CVE-2026-85617snipe-it before 8.6.3 Authorization Bypass via Bulk Delete Exploitation status Not confirmed Fix Published 09/04/2026 Severity High CVE-2026-85616Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance Exploitation status Public exploit Fix Published 09/04/2026 Severity High CVE-2026-84206Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore Exploitation status Public exploit Fix Published 09/01/2026 Severity Medium CVE-2026-55694Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover Exploitation status Public exploit Fix Published 08/19/2026 Severity High CVE-2026-55643Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode Exploitation status Not known exploited Fix Published 08/19/2026 Severity High CVE-2026-55703Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET Exploitation status Public exploit Fix Published 08/19/2026 Severity Medium CVE-2026-61807Snipe-IT: Stored DOM XSS via table selected-count IDs Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-55519Snipe-IT: Improper Authorization in File Deletion (IDOR) Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-55482Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-55483Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-50550Snipe-IT: 2FA reset privilege bypass Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-49870Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-49976Snipe-IT: User Account Escalation via CSV Import Exploitation status Not known exploited Fix Published 08/19/2026 Severity Medium CVE-2026-19579Snipe-IT Checkout Request Cancellation IDOR Exploitation status Not known exploited Fix Published 08/11/2026 Severity Medium CVE-2026-55481Snipe-IT: CSS Injection via `header_color` Setting Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55475Snipe-IT: Import created_by can be overwritten Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55469Snipe-IT: Path traversal vulnerability via CSV import `image` field Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55461Snipe-IT: Open Redirect After User Edit Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55479Snipe-IT: Incorrect permission for legacy license checkin API Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55452Snipe-IT: CSV formula injection in Activity Report export Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55466Snipe-IT: Stored XSS via inline-served attachment Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium CVE-2026-55515Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium CVE-2026-55462Snipe-IT: Authorization bypass on print inventory page Exploitation status Public exploit Fix Published 07/10/2026 Severity Medium CVE-2026-55464Snipe-IT: Stored XSS via Markdown custom field Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55460Snipe-IT: Authorization bypass on bulk editing users Exploitation status Public exploit Fix Published 07/10/2026 Severity High CVE-2026-55472Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55476Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55478Snipe-IT: Missing object-level authorization in Kits API Exploitation status Not known exploited Fix Published 07/10/2026 Severity Medium CVE-2026-55843Snipe-IT: Improper Privilege Management Exploitation status Not known exploited Fix Published 07/10/2026 Severity High CVE-2026-55516Snipe-IT: Cross-company asset maintenance re-parenting via API update Exploitation status Not known exploited Fix Published 07/10/2026 Severity High CVE-2026-55474Snipe-IT: Directory traversal in displaySig Exploitation status Not known exploited Fix Published 07/10/2026 Severity High CVE-2026-54329Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API Exploitation status Not known exploited Fix Published 07/10/2026 Severity High CVE-2026-48492Snipe-IT's selectlist visibility is too permissive Exploitation status Not known exploited Fix Not confirmed Published 07/08/2026 Severity Medium CVE-2026-55542Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL Exploitation status Not known exploited Fix Not confirmed Published 07/08/2026 Severity Low CVE-2026-48493Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment Exploitation status Not known exploited Fix Published 06/23/2026 Severity Medium CVE-2026-48507Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users Exploitation status Not known exploited Fix Not confirmed Published 06/08/2026 Severity High CVE-2026-44833Snipe-IT: Open redirect vulnerability Exploitation status Not known exploited Fix Published 05/26/2026 Severity Medium CVE-2026-44832Snipe-IT: Privilege Escalation via API Permissions Assignment Exploitation status Not known exploited Fix Published 05/26/2026 Severity High CVE-2026-44831Snipe-IT: XSS vulnerability in component notes Exploitation status Not known exploited Fix Published 05/26/2026 Severity Medium 
