InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,499 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,499
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product snipeitapp:snipe-it. Show all products

92 CVEs, showing 51 to 92PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2026-86737Medium 4.3snipe-it before 8.7.0 Missing Authorization via barcode endpoint
Assigned by VulnCheck
Sep 8, 2026
CVE-2026-86738High 8.7Snipe-IT before 8.7.0 CSS Injection via Custom CSS
Assigned by VulnCheck
Sep 8, 2026
CVE-2026-86739Low 3.1Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86740Low 3.8Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86741High 8.5Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86742Medium 6.5Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86743Medium 5.0Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86744Low 2.2snipe-it before 8.7.0 Race Condition in Asset Checkout
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86745Medium 6.5Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86746Medium 6.4Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86747Medium 5.4snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86748Medium 6.1Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86749Medium 6.3snipe-it before 8.7.0 Data Loss via Failed Image Write
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86750High 7.7snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86751High 8.5Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86752Medium 5.4snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86753Medium 4.3snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86754High 7.3Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86755Medium 5.4Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86756Medium 6.1Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86757Medium 6.5Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86758Medium 6.5Snipe-IT before 8.7.0 License Key Exposure via CSV Export
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86759High 7.1Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86760Medium 5.4snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86761Medium 4.3snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86762High 8.1Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86763Low 3.5snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86764Medium 6.5Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86765Medium 6.5Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86766Medium 6.5Snipe-IT 8.6.3 Race Condition via Consumable Checkout
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86767Medium 5.0Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86768Medium 5.4Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86769Medium 4.3Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86770High 8.1Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86771High 7.6Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86772Medium 5.4Snipe-IT 8.6.3 Stored XSS via Department Names
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86773Medium 5.4Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-86774Medium 6.3Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
Assigned by VulnCheck
Sep 9, 2026
CVE-2026-88894Medium 5.4Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-63498High 8.7Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-63493High 8.6Snipe-IT: 2FA bypass via the API token flow
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-62368High 8.1Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Assigned by GitHub_M
Sep 24, 2026
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.