Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
109 results · page 2 of 3
Sep 8, 2026Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mCVE-2026-86733 · Other software · grokability · reported by VulnCheckHigh 8.6
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional `clean` sanitizer parameter — which is not applied by default because DB_SANITIZE_BY_DEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APP_KEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 4, 2026snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users CVE-2026-85617 · Other software · grokability · reported by VulnCheckHigh 8.7
snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions and modify or disable accounts they should not access.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 4, 2026Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabledCVE-2026-85616 · Other software · grokability · reported by VulnCheckHigh 8.4
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 1, 2026Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restCVE-2026-84206 · Other software · grokability · reported by VulnCheckMedium 5.3
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-61807 · Other software · grokability · reported by GitHubMedium 6.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a selector, concatenates countId.substring(1) into an HTML string, and passes the string to jQuery .after(). A crafted name can therefore execute JavaScript when an authenticated user views the manufacturer detail page or supplier detail page, potentially exposing data or actions available to that session. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55703 · Other software · grokability · reported by GitHubMedium 4.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55694 · Other software · grokability · reported by GitHubHigh 7.1
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55643 · Other software · grokability · reported by GitHubHigh 7.6
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55519 · Other software · grokability · reported by GitHubMedium 5.4
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55483 · Other software · grokability · reported by GitHubMedium 4.9
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55482 · Other software · grokability · reported by GitHubMedium 6.3
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-50550 · Other software · grokability · reported by GitHubMedium 5.8
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset(). The endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled. This issue is fixed in version 8.5.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-49976 · Other software · grokability · reported by GitHubMedium 6.5
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields gate by unsetting username, email, password, and activated on the model, but app/Importer/ItemImporter.php sanitizeItemForUpdating() rebuilds the update array from the raw CSV row in $this->item, restoring the unauthorized values. The app/Http/Controllers/ImportController.php import path checks import permission but does not require users.edit. This issue is fixed in version 8.6.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Snipe-IT is an IT asset/license management system.CVE-2026-49870 · Other software · grokability · reported by GitHubMedium 5.9
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successful guess creates a fully authenticated session. When two_factor_enabled is 1, POST /account/profile with two_factor_optin=0 can disable two-factor authentication without OTP reverification, while required mode 2 prevents that opt-out. An administrator can also use POST /api/v1/users/two_factor_reset to clear another user's secret. This issue is fixed in version 8.6.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint.CVE-2026-19579 · Other software · Grokability · reported by vulnreport@tenable.comMedium 5.3
Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55515 · Other software · grokability · reported by GitHubMedium 5
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55481 · Other software · grokability · reported by GitHubMedium 6.2
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, default.blade.php renders header_color and related branding color settings inside a CSS style block with HTML escaping that is insufficient for the CSS context, allowing a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55479 · Other software · grokability · reported by GitHubMedium 5.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the legacy single-seat license checkin flow authorizes the action with the checkout permission instead of the checkin permission, allowing a user who can assign licenses but not unassign them to directly access the old checkin endpoint and reclaim a license seat assigned to another user or asset. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55475 · Other software · grokability · reported by GitHubMedium 5.7
Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55469 · Other software · grokability · reported by GitHubMedium 6.5
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55466 · Other software · grokability · reported by GitHubMedium 6.2
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55462 · Other software · grokability · reported by GitHubMedium 4.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55461 · Other software · grokability · reported by GitHubMedium 6.1
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect()->intended(...) when redirect_option=back is submitted, allowing Snipe-IT to be used as a trusted redirector after a legitimate user edit action. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55452 · Other software · grokability · reported by GitHubMedium 4.8
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet software. This issue is fixed in version 8.5.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55843 · Other software · grokability · reported by GitHubHigh 7
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user’s permissions with a sparse result, allowing an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target’s administrative or granular permissions. This issue is fixed in version 8.6.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55516 · Other software · grokability · reported by GitHubHigh 7.7
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55478 · Other software · grokability · reported by GitHubMedium 5.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user with predefined-kit permissions to bind a license they should not be able to access or manage into a kit. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55476 · Other software · grokability · reported by GitHubMedium 5.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55474 · Other software · grokability · reported by GitHubHigh 7.1
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55472 · Other software · grokability · reported by GitHubMedium 4.3
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location under a parent location from a different company. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55464 · Other software · grokability · reported by GitHubMedium 4.8
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55460 · Other software · grokability · reported by GitHubHigh 7.1
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Snipe-IT is an IT asset/license management system.CVE-2026-54329 · Other software · grokability · reported by GitHubHigh 8.5
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Snipe-IT is an IT asset/license management system.CVE-2026-48492 · Other software · grokability · reported by GitHubMedium 4.9
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Snipe-IT is an IT asset/license management system.CVE-2026-55542 · Other software · grokability · reported by GitHubLow 1.3
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. Version 8.6.1 contains a patch.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026Snipe-IT is an IT asset/license management system.CVE-2026-48493 · Other software · grokability · reported by GitHubMedium 5.5
Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026Snipe-IT is an IT asset/license management system.CVE-2026-48507 · Other software · grokability · reported by GitHubHigh 7.1
Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Snipe-IT is an IT asset/license management system.CVE-2026-44833 · Other software · grokability · reported by GitHubMedium 5.9
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Snipe-IT is an IT asset/license management system.CVE-2026-44832 · Other software · grokability · reported by GitHubHigh 8.7
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Snipe-IT is an IT asset/license management system.CVE-2026-44831 · Other software · grokability · reported by GitHubMedium 4.8
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2026ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.CVE-2025-57282 · Other software · reported by MITREHigh 8.8
ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnpmjs.com
May 7, 2026Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbCVE-2026-37709 · Other software · Snipeitapp · reported by MITRECritical 9.8
Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment.CVE-2025-15602 · Other software · Grokability, Inc. · reported by VulnCheckHigh 8.7
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsnipeitapp.com
Jan 14, 2026Outray openSource ngrok alternative.CVE-2026-22819 · Other software · akinloluwami · reported by GitHubMedium 5.9
Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5.
- Product
- outray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Outray openSource ngrok alternative.CVE-2026-22820 · Other software · akinloluwami · reported by GitHubMedium 6.3
Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.
- Product
- outray
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page.CVE-2025-30755 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revision parameter. The application reflects unsanitized user input into the HTML output.
- Product
- OpenGrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025AIRI is a self-hosted, artificial intelligence based Grok Companion.CVE-2025-59053 · Other software · moeru-ai · reported by GitHubCritical 9.6
AIRI is a self-hosted, artificial intelligence based Grok Companion. In v0.7.2-beta.2 in the `packages/stage-ui/src/components/MarkdownRenderer.vue` path, the Markdown content is processed using the useMarkdown composable, and the processed HTML is rendered directly into the DOM using v-html. An attacker creates a card file containing malicious HTML/JavaScript, then simply processes it using the highlightTagToHtml function (which simply replaces template tags without HTML escaping), and then directly renders it using v-html, leading to cross-site scripting (XSS). The project also exposes the Tauri API, which can be called from the frontend. The MCP plugin exposes a command execution interface function in `crates/tauri-plugin-mcp/src/lib.rs`. This allows arbitrary command execution. `connect_server` directly passes the user-supplied `command` and `args` parameters to `Command::new(command).args(args)` without any input validation or whitelisting. Thus, the previous XSS exploit could achieve command execution through this interface. v0.7.2-beta.3 fixes the issue.
- Product
- airi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page.CVE-2025-21572 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handling of path segments. The application reflects unsanitized user input into the HTML output.
- Product
- OpenGrok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-47226 · Other software · snipeitapp · reported by MITREMedium 5
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2021Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func<std::__1::__bind<grk::T1DecompressCVE-2021-45935 · Other software · Grok Project · reported by MITREMedium 5.5
Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func<std::__1::__bind<grk::T1DecompressScheduler::deco and std::__1::packaged_task<int).
- Product
- Grok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.