snipe/snipe-it vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-63498Highsnipe/snipe-it: Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVE-2026-62368Highsnipe/snipe-it: Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVE-2026-63493Highsnipe/snipe-it: Snipe-IT: 2FA bypass via the API token flow CVE-2026-55843Highsnipe/snipe-it: Snipe-IT has an Improper Privilege Management issue CVE-2026-55516Highsnipe/snipe-it: Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update CVE-2026-55515Mediumsnipe/snipe-it: Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint CVE-2026-55481Mediumsnipe/snipe-it: Snipe-IT has CSS Injection via `header_color` Setting CVE-2026-55479Mediumsnipe/snipe-it: Snipe-IT has incorrect permission for legacy license checkin API CVE-2026-55478Mediumsnipe/snipe-it: Snipe-IT has missing object-level authorization in Kits API CVE-2026-55476Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CVE-2026-55475Mediumsnipe/snipe-it: Snipe-IT's import created_by can be overwritten CVE-2026-55474Highsnipe/snipe-it: Snipe-IT vulnerable to directory traversal in displaySig CVE-2026-55472Mediumsnipe/snipe-it: Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CVE-2026-55469Lowsnipe/snipe-it: Snipe-IT has a path traversal vulnerability via CSV import `image` field CVE-2026-55466Mediumsnipe/snipe-it: Snipe-IT vulnerable to stored XSS via inline-served attachment CVE-2026-55464Mediumsnipe/snipe-it: Snipe-IT vulnerable to stored XSS via Markdown custom field CVE-2026-55462Mediumsnipe/snipe-it: Snipe-IT has an authorization bypass on print inventory page CVE-2026-55461Mediumsnipe/snipe-it: Snipe-IT has an Open Redirect After User Edit CVE-2026-55460Highsnipe/snipe-it: Snipe-IT has an authorization bypass on bulk editing users CVE-2026-55452Mediumsnipe/snipe-it: Snipe-IT has CSV formula injection in Activity Report export CVE-2026-61807Mediumsnipe/snipe-it: Snipe-IT: Stored DOM XSS via table selected-count IDs CVE-2026-55703Mediumsnipe/snipe-it: Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET CVE-2026-55694Highsnipe/snipe-it: Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover CVE-2026-55643Highsnipe/snipe-it: Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode CVE-2026-54329Highsnipe/snipe-it: Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo