2026

knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() metho

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updat

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedName

Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing atta

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to auth

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API en

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full M

Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (P

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset

Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GE

Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewir

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kerne

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to e

Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/U

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, a

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlContro

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST,

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticat

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on que

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to r

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user reco

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequ

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint.

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endp

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization o

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never include

Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset chec

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. Rep

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmatio

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the genera

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authe

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients.

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that all

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows re

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with ST

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated at

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains