Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

snipe-it — Vulnerabilities & Security Advisories 92

All 92 CVE vulnerabilities found in snipe-it, with AI-generated Chinese analysis, references, and POCs.

This page covers vulnerability aggregation for Snipe-IT, an open-source asset management application developed by Snipe-IT LLC. It collects data related to common weakness types such as cross-site scripting, SQL injection, and path traversal vulnerabilities affecting this specific software product. The information presented spans from the initial public release of the software through to the most recent security advisories issued by the vendor or discovered by the security community. By consulting this resource, users can effectively track the historical advisory pattern of the vendor to assess their remediation speed and transparency. Additionally, researchers can use this data to better understand the specific implementation flaws and weakness classes that frequently arise in asset management tools. Users may also look up the complete vulnerability history of Snipe-IT to evaluate the long-term security posture of the application. This aggregated view aids in risk assessment and helps administrators prioritize updates based on the severity and prevalence of known issues. The content is organized to facilitate a clear understanding of how vulnerabilities have evolved in this product line over time. It serves as a neutral reference point for security analysts, developers, and IT professionals seeking factual data without speculative commentary. All entries are derived from official security notices and verified third-party reports.

Vendor: snipe

CVE ID Title CVSS Severity Published
CVE-2026-114064 Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint CWE-203 5.5 Medium 2026-10-21
CVE-2026-62368 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CWE-79 8.1 High 2026-09-24
CVE-2026-63493 Snipe-IT: 2FA bypass via the API token flow CWE-288 8.6 High 2026-09-24
CVE-2026-63498 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CWE-79 8.7 High 2026-09-24
CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout CWE-863 5.4 Medium 2026-09-10
CVE-2026-86774 Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy CWE-284 6.3 Medium 2026-09-09
CVE-2026-86773 Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints CWE-863 5.4 Medium 2026-09-09
CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names CWE-79 5.4 Medium 2026-09-09
CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num CWE-918 7.6 High 2026-09-09
CVE-2026-86770 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CWE-178 8.1 High 2026-09-09
CVE-2026-86769 Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout CWE-282 4.3 Medium 2026-09-09
CVE-2026-86768 Snipe-IT before 8.7.0 Improper Input Validation via API Checkout CWE-20 5.4 Medium 2026-09-09
CVE-2026-86766 Snipe-IT 8.6.3 Race Condition via Consumable Checkout CWE-362 6.5 Medium 2026-09-09
CVE-2026-86767 Snipe-IT before 8.7.0 Cross-Company Read via requested-assets CWE-200 5.0 Medium 2026-09-09
CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint CWE-862 6.5 Medium 2026-09-09
CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components CWE-862 6.5 Medium 2026-09-09
CVE-2026-86763 snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer CWE-639 3.5 Low 2026-09-09
CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware CWE-862 8.1 High 2026-09-09
CVE-2026-86761 snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints CWE-639 4.3 Medium 2026-09-09
CVE-2026-86760 snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag CWE-863 5.4 Medium 2026-09-09
CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer CWE-862 7.1 High 2026-09-09
CVE-2026-86758 Snipe-IT before 8.7.0 License Key Exposure via CSV Export CWE-204 6.5 Medium 2026-09-09
CVE-2026-86756 Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState CWE-601 6.1 Medium 2026-09-09
CVE-2026-86757 Snipe-IT before 8.7.0 Information Disclosure via Custom Fields CWE-862 6.5 Medium 2026-09-09
CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth CWE-863 5.4 Medium 2026-09-09
CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients CWE-863 7.3 High 2026-09-09
CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint CWE-863 4.3 Medium 2026-09-09
CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints CWE-863 5.4 Medium 2026-09-09
CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CWE-73 8.5 High 2026-09-09
CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update CWE-863 7.7 High 2026-09-09

All 92 known CVE vulnerabilities affecting snipe-it with full Chinese analysis, references, and POCs where available.