Latest vulnerabilities for "snipe-it snipe-it"

Snipe-IT Snipe-ITSnipe-IT Checkout Request Cancellation IDOR

Risk 34

Severity

5.3

First published (updated )

CVE-2026-19579

Snipe-IT Snipe-ITSnipe-IT: CSS Injection via `header_color` Setting

Risk 50

Severity

6.2

First published (updated )

CVE-2026-55481

Snipe-IT Snipe-ITSnipe-IT: Import created_by can be overwritten

Risk 33

Severity

5.7

First published (updated )

CVE-2026-55475

Snipe-IT Snipe-ITSnipe-IT: Path traversal vulnerability via CSV import `image` field

Risk 49

Severity

6.5

First published (updated )

CVE-2026-55469

Snipe-IT Snipe-ITSnipe-IT: Open Redirect After User Edit

Risk 38

Severity

6.1

First published (updated )

CVE-2026-55461

Snipe-IT Snipe-ITSnipe-IT: Incorrect permission for legacy license checkin API

Risk 26

Severity

5.3

First published (updated )

CVE-2026-55479

Snipe-IT Snipe-ITSnipe-IT: CSV formula injection in Activity Report export

Risk 54

Severity

4.8

First published (updated )

CVE-2026-55452

Snipe-IT Snipe-ITSnipe-IT: Stored XSS via inline-served attachment

Risk 61

Severity

6.2

First published (updated )

CVE-2026-55466

Snipe-IT Snipe-ITSnipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Risk 26

Severity

5

First published (updated )

CVE-2026-55515

Snipe-IT Snipe-ITSnipe-IT: Authorization bypass on print inventory page

Risk 22

Severity

4.3

First published (updated )

CVE-2026-55462

Snipe-IT Snipe-ITSnipe-IT: Stored XSS via Markdown custom field

Risk 34

Severity

4.8

First published (updated )

CVE-2026-55464

Snipe-IT Snipe-ITSnipe-IT: Authorization bypass on bulk editing users

Risk 48

Severity

7.1

First published (updated )

CVE-2026-55460

Snipe-IT Snipe-ITSnipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Risk 22

Severity

4.3

First published (updated )

CVE-2026-55472

Snipe-IT Snipe-ITSnipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Risk 26

Severity

5.3

First published (updated )

CVE-2026-55476

Snipe-IT Snipe-ITSnipe-IT: Missing object-level authorization in Kits API

Risk 34

Severity

5.3

First published (updated )

CVE-2026-55478

Snipe-IT Snipe-ITSnipe-IT: Improper Privilege Management

Risk 52

Severity

7

First published (updated )

CVE-2026-55843

Snipe-IT Snipe-ITSnipe-IT: Cross-company asset maintenance re-parenting via API update

Risk 44

Severity

7.7

First published (updated )

CVE-2026-55516

Snipe-IT Snipe-ITSnipe-IT: Directory traversal in displaySig

Risk 40

Severity

7.1

First published (updated )

CVE-2026-55474

Snipe-IT Snipe-ITSnipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Risk 39

Severity

5.5

First published (updated )

CVE-2026-48493

Snipe-IT Snipe-ITSnipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Risk 48

Severity

7.1

First published (updated )

CVE-2026-48507

Snipe-IT Snipe-ITAn improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows…

Risk 38

Severity

6.5

First published (updated )

CVE-2026-38533

Snipe-IT Snipe-ITXSS

Risk 34

Severity

5.4

First published (updated )

CVE-2025-63743

Snipe-IT Snipe-ITXSS

Risk 34

Severity

5.4

First published (updated )

CVE-2025-65621

Snipe-IT Snipe-ITXSS

Risk 34

Severity

5.4

First published (updated )

CVE-2025-65622

Trending

Snipe-IT Snipe-ITSnipe-IT Checkout Request Cancellation IDOR

Snipe-IT Snipe-ITSnipe-IT: CSS Injection via `header_color` Setting

Snipe-IT Snipe-ITSnipe-IT: Import created_by can be overwritten

Snipe-IT Snipe-ITSnipe-IT: Path traversal vulnerability via CSV import `image` field

Snipe-IT Snipe-ITSnipe-IT: Open Redirect After User Edit

Don't miss critical vulnerabilities

Snipe-IT Snipe-ITSnipe-IT: Incorrect permission for legacy license checkin API

Snipe-IT Snipe-ITSnipe-IT: CSV formula injection in Activity Report export

Snipe-IT Snipe-ITSnipe-IT: Stored XSS via inline-served attachment

Snipe-IT Snipe-ITSnipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Snipe-IT Snipe-ITSnipe-IT: Authorization bypass on print inventory page

Don't miss critical vulnerabilities

Snipe-IT Snipe-ITSnipe-IT: Stored XSS via Markdown custom field

Snipe-IT Snipe-ITSnipe-IT: Authorization bypass on bulk editing users

Snipe-IT Snipe-ITSnipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT Snipe-ITSnipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Snipe-IT Snipe-ITSnipe-IT: Missing object-level authorization in Kits API

Don't miss critical vulnerabilities

Snipe-IT Snipe-ITSnipe-IT: Improper Privilege Management

Snipe-IT Snipe-ITSnipe-IT: Cross-company asset maintenance re-parenting via API update

Snipe-IT Snipe-ITSnipe-IT: Directory traversal in displaySig

Snipe-IT Snipe-ITSnipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Snipe-IT Snipe-ITSnipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Don't miss critical vulnerabilities

Snipe-IT Snipe-ITAn improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows…

Snipe-IT Snipe-ITXSS

Snipe-IT Snipe-ITXSS

Snipe-IT Snipe-ITXSS

Company

Resources

Contact