Latest high and critical flaws
- CVE-2026-116201 Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check iHigh 8.7 · Oct 25, 2026
- CVE-2026-116200 Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds.High 8.2 · Oct 25, 2026
- CVE-2026-116199 Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google Critical 9.2 · Oct 25, 2026
- CVE-2026-63498 Snipe-IT is an IT asset/license management system.High 8.7 · Sep 24, 2026
- CVE-2026-63493 Snipe-IT is an IT asset/license management system.High 8.6 · Sep 24, 2026
- CVE-2026-62368 Snipe-IT is an IT asset/license management system.High 8.1 · Sep 24, 2026
- CVE-2026-86771 Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to injeHigh 8.3 · Sep 9, 2026
- CVE-2026-86770 Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registeriHigh 8.6 · Sep 9, 2026
- CVE-2026-86766 Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/High 7.1 · Sep 9, 2026
- CVE-2026-86765 Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint.High 7.1 · Sep 9, 2026
- CVE-2026-86764 Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/cHigh 7.1 · Sep 9, 2026
- CVE-2026-86762 Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not High 8.6 · Sep 9, 2026
- CVE-2026-86759 Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify auHigh 7.1 · Sep 9, 2026
- CVE-2026-86758 Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only liHigh 7.1 · Sep 9, 2026
- CVE-2026-86757 Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/High 7.1 · Sep 9, 2026
- CVE-2026-86754 Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with aHigh 8.5 · Sep 9, 2026
- CVE-2026-86751 Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue serHigh 8.4 · Sep 9, 2026
- CVE-2026-86750 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API.High 8.3 · Sep 9, 2026
- CVE-2026-86749 Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages().High 7 · Sep 9, 2026
- CVE-2026-86746 Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within compoHigh 7.4 · Sep 9, 2026
- CVE-2026-86741 Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails.High 8.4 · Sep 9, 2026
- CVE-2026-86738 Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greatCritical 9.3 · Sep 8, 2026
- CVE-2026-86734 Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit uHigh 7.1 · Sep 8, 2026
- CVE-2026-86733 Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mHigh 8.6 · Sep 8, 2026
- CVE-2026-85617 snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users High 8.7 · Sep 4, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.