Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT: Import created_by can be overwritten

Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT: Improper Authorization in File Deletion (IDOR)

Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT: Stored XSS via Markdown custom field

Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT: XSS vulnerability in component notes

Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Snipe-IT: CSS Injection via `header_color` Setting

Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout

snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints

snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT: Incorrect permission for legacy license checkin API

Snipe-IT: Authorization bypass on print inventory page

Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains

snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer

snipe-it before 8.7.0 Race Condition in Asset Checkout