SN
Product
Snipe-IT
135
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Severity mix
Critical 3High 38Medium 90Low 4
Watch
Add Snipe-IT to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-4018 | 5.4 | Dec 1 | Cross-site Scripting (XSS) - Stored in snipe/snipe-it Affected: before 5.3.3 |
| CVE-2021-3961 | 5.4 | Nov 19 | Cross-site Scripting (XSS) - Stored in snipe/snipe-it Affected: before 5.3.2 |
| CVE-2021-3938 | 5.4 | Nov 13 | Cross-site Scripting (XSS) - Generic in snipe/snipe-it Affected: through 5.3.1 |
| CVE-2021-3879 | 5.4 | Oct 19 | Cross-site Scripting (XSS) - Stored in snipe/snipe-it Affected: before 5.3.0 |
| CVE-2022-44381 | 5.3 | Dec 25 | Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request Affected: through 6.0.14 |
| CVE-2022-0622 | 5.3 | Feb 17 | Generation of Error Message Containing Sensitive Information in snipe/snipe-it Affected: through 5.3.10; 6.0.0; 6.0.0 |
| CVE-2026-86767 | 5.0 | Sep 9 | Snipe-IT before 8.7.0 Cross-Company Read via requested-assets Affected: before 8.7.0 |
| CVE-2026-86743 | 5.0 | Sep 9 | Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report Affected: before 8.7.0 |
| CVE-2026-86735 | 5.0 | Sep 8 | snipe-it before 8.7.0 SSRF via IPv6 transition address bypass Affected: before 8.7.0 |
| CVE-2026-55515 | 5.0 | Jul 10 | Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint Affected: before 8.6.2 |
| CVE-2026-55481 | 4.8 | Jul 10 | Snipe-IT: CSS Injection via `header_color` Setting Affected: before 8.6.2 |
| CVE-2022-3035 | 4.8 | Aug 29 | Cross-site Scripting (XSS) - Stored in snipe/snipe-it Affected: before 6.0.11 |
| CVE-2022-32061 | 4.8 | Jul 7 | An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file Affected: 6.0.2 |
| CVE-2022-32060 | 4.8 | Jul 7 | An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file Affected: 6.0.2 |
| CVE-2026-116198 New | 4.3 | Oct 25 | Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store Affected: before 8.7.0 |
| CVE-2026-86769 | 4.3 | Sep 9 | Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout Affected: before 8.7.0 |
| CVE-2026-86761 | 4.3 | Sep 9 | snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints Affected: before 8.7.0 |
| CVE-2026-86753 | 4.3 | Sep 9 | snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint Affected: before 8.7.0 |
| CVE-2026-86737 | 4.3 | Sep 8 | snipe-it before 8.7.0 Missing Authorization via barcode endpoint Affected: before 8.7.0 |
| CVE-2026-86736 | 4.3 | Sep 8 | snipe-it before 8.7.0 Checkout Request Counter Integrity Failure Affected: before 8.7.0 |
| CVE-2026-84206 | 4.3 | Sep 1 | Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore Affected: before 8.7.0 |
| CVE-2026-55703 | 4.3 | Aug 19 | Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET Affected: before 8.6.3 |
| CVE-2026-55479 | 4.3 | Jul 10 | Snipe-IT: Incorrect permission for legacy license checkin API Affected: before 8.6.2 |
| CVE-2026-55462 | 4.3 | Jul 10 | Snipe-IT: Authorization bypass on print inventory page Affected: before 8.6.2 |
| CVE-2026-55472 | 4.3 | Jul 10 | Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation Affected: before 8.6.2 |
| CVE-2026-55476 | 4.3 | Jul 10 | Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter Affected: before 8.6.0 |
| CVE-2026-55542 | 4.3 | Jul 8 | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL Affected: before 8.6.0 |
| CVE-2022-3173 | 4.3 | Sep 17 | Improper Authentication in snipe/snipe-it Affected: before 6.0.10 |
| CVE-2022-0569 | 4.3 | Feb 12 | Observable Discrepancy in snipe/snipe-it Affected: before 5.3.9 |
| CVE-2021-4089 | 4.3 | Dec 10 | Improper Access Control in snipe/snipe-it Affected: through 5.3.3 |
| CVE-2021-3931 | 4.3 | Nov 13 | Cross-Site Request Forgery (CSRF) in snipe/snipe-it Affected: through 5.3.1 |
| CVE-2026-86740 | 3.8 | Sep 9 | Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains Affected: before 8.7.0 |
| CVE-2026-86763 | 3.5 | Sep 9 | snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer Affected: 7.0.12 before 8.7.0 |
| CVE-2025-47226 | 3.3 | May 2 | Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information Affected: before 8.1.0 |
| CVE-2026-86744 | 2.2 | Sep 9 | snipe-it before 8.7.0 Race Condition in Asset Checkout Affected: before 8.7.0 |