CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product snipeitapp:snipe-it. Show all products

92 CVEs, showing 51 to 92PreviousPage 2 of 2
CVESeverityTitlePublished
CVE-2026-55643High 7.6Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-55703Medium 4.3Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-61807Medium 6.3Snipe-IT: Stored DOM XSS via table selected-count IDs
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-55519Medium 5.4Snipe-IT: Improper Authorization in File Deletion (IDOR)
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-55482Medium 6.3Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-55483Medium 4.9Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-50550Medium 5.8Snipe-IT: 2FA reset privilege bypass
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-49870Medium 5.9Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-49976Medium 6.5Snipe-IT: User Account Escalation via CSV Import
Assigned by GitHub_M
Aug 19, 2026
CVE-2026-19579Medium 5.4Snipe-IT Checkout Request Cancellation IDOR
Assigned by tenable
Aug 11, 2026
CVE-2026-55515Medium 5.0Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55481Medium 4.8Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55479Medium 4.3Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55475Medium 5.7Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55469Medium 6.5Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55466High 8.7Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55462Medium 4.3Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55461Medium 6.1Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55452High 7.3Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55843Medium 6.5Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55516High 7.7Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55478Medium 5.4Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55476Medium 4.3Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55474Medium 6.5Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55472Medium 4.3Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55464Medium 5.4Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-55460High 7.1Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-54329High 7.7Snipe-IT is an IT asset/license management system.Jul 10, 2026
CVE-2026-48492Medium 6.5Snipe-IT is an IT asset/license management system.Jul 8, 2026
CVE-2026-55542Medium 4.3Snipe-IT is an IT asset/license management system.Jul 8, 2026
CVE-2026-48493Medium 5.5Snipe-IT is an IT asset/license management system.Jun 23, 2026
CVE-2026-48507High 7.1Snipe-IT is an IT asset/license management system.Jun 8, 2026
CVE-2026-44833High 7.1Snipe-IT is an IT asset/license management system.May 26, 2026
CVE-2026-44832High 8.8Snipe-IT is an IT asset/license management system.May 26, 2026
CVE-2026-44831Medium 5.4Snipe-IT is an IT asset/license management system.May 26, 2026
CVE-2026-37709Critical 9.8Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controller…May 7, 2026
CVE-2026-38533Medium 6.5An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and acco…Apr 14, 2026
CVE-2025-15602High 8.8Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation
Assigned by VulnCheck
Mar 6, 2026
CVE-2025-65622Medium 5.4Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.Dec 1, 2025
CVE-2025-65621Medium 5.4Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.Dec 1, 2025
CVE-2025-64027Medium 6.1Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow.Nov 20, 2025
CVE-2025-63601Critical 9.9Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system comm…Nov 5, 2025
PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.