snipe/snipe-it vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54329Highsnipe/snipe-it: Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection CVE-2026-55542Lowsnipe/snipe-it: Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL CVE-2026-55519Lowsnipe/snipe-it: Snipe-IT has Improper Authorization in File Deletion (IDOR)CVE-2026-55483Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation CVE-2026-55482Mediumsnipe/snipe-it: Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update CVE-2026-50550Mediumsnipe/snipe-it: Snipe-IT has a 2FA reset privilege bypass CVE-2026-49976Mediumsnipe/snipe-it: Snipe-IT Vulnerable to User Account Escalation via CSV Import CVE-2026-49870Mediumsnipe/snipe-it: Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`CVE-2026-48507Highsnipe/snipe-it: Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users CVE-2026-48493Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment CVE-2026-48492Mediumsnipe/snipe-it: Snipe-IT's selectlist visibility is too permissive CVE-2026-44833Mediumsnipe/snipe-it: Snipe-IT has an open redirect vulnerability CVE-2026-37709Criticalsnipe/snipe-it: Snipe-IT has insecure permissions in file uploads CVE-2026-44832Highsnipe/snipe-it: Snipe-IT has Privilege Escalation via API Permissions Assignment CVE-2026-44831Mediumsnipe/snipe-it: Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)CVE-2025-15602Highsnipe/snipe-it: Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment CVE-2025-65622Mediumsnipe/snipe-it: Snipe-IT allows stored XSS via the Locations "Country" field CVE-2025-65621Mediumsnipe/snipe-it: Snipe-IT is vulnerable to stored cross-site scripting CVE-2025-64027Mediumsnipe/snipe-it: Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow CVE-2025-59713Mediumsnipe/snipe-it: Snipe-IT allows unsafe deserialization CVE-2025-59712Mediumsnipe/snipe-it: Snipe-IT allows XSS CVE-2025-47226Mediumsnipe/snipe-it: Grokability Snipe-IT has incorrect authorization for accessing asset information CVE-2024-51093Highsnipe/snipe-it: Cross Site Scripting vulnerability in Snipe-IT CVE-2024-48987Highsnipe/snipe-it: Snipe-IT remote code execution CVE-2024-5685Highsnipe/snipe-it: Snipe-IT allows users to promote or demote themselves or other users

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo