What’s Vulnerable › Products

grokability snipe-it vulnerabilities

136 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 100 published in the last 12 months.

Check whether your grokability snipe-it version is affected

Latest grokability snipe-it vulnerabilities

• CVE-2026-116201 — Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition (CVSS 8.8)
• CVE-2026-116200 — Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() (CVSS 5.9)
• CVE-2026-116198 — Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store (CVSS 4.3)
• CVE-2026-116199 — Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback (CVSS 8.1)
• CVE-2026-114064 — Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint (CVSS 5.5)
• CVE-2026-63498 — Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API (CVSS 5.4)
• CVE-2026-63493 — Snipe-IT: 2FA bypass via the API token flow (CVSS 8.1)
• CVE-2026-62368 — Snipe-IT: Stored XSS via Custom Field name in asset-list column headers (CVSS 8.4)
• CVE-2026-88894 — Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout (CVSS 5.4)
• CVE-2026-86774 — Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy (CVSS 6.3)
• CVE-2026-86773 — Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints (CVSS 5.4)
• CVE-2026-86772 — Snipe-IT 8.6.3 Stored XSS via Department Names (CVSS 5.4)
• CVE-2026-86771 — Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num (CVSS 7.6)
• CVE-2026-86770 — Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation (CVSS 8.1)
• CVE-2026-86769 — Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout (CVSS 4.3)
• CVE-2026-86768 — Snipe-IT before 8.7.0 Improper Input Validation via API Checkout (CVSS 5.4)
• CVE-2026-86767 — Snipe-IT before 8.7.0 Cross-Company Read via requested-assets (CVSS 5.0)
• CVE-2026-86766 — Snipe-IT 8.6.3 Race Condition via Consumable Checkout (CVSS 6.5)
• CVE-2026-86765 — Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint (CVSS 6.5)
• CVE-2026-86764 — Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components (CVSS 6.5)
• CVE-2026-86763 — snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer (CVSS 3.5)
• CVE-2026-86762 — Snipe-IT before 8.7.0 Authentication Bypass via API Middleware (CVSS 8.1)
• CVE-2026-86761 — snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints (CVSS 4.3)
• CVE-2026-86760 — snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag (CVSS 5.4)
• CVE-2026-86759 — Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer (CVSS 7.1)