{"schema_version":1,"title":"Snipeitapp vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 47 vulnerabilities in Snipeitapp: 0 in the last 7 days and 44 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86774, was published on 9 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/snipeitapp","json_url":"https://junglewise.ai/threats/vendors/snipeitapp.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/snipeitapp","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":12,"all_time":47,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":44,"last_90_days":44,"last_365_days":47},"latest":[{"cve":"CVE-2026-86774","cvss":6.3,"epss":0.0029,"slug":"cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments","title":"Snipe-IT broken access control in Asset Model file attachments","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:28.363+00:00","url":"https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments"},{"cve":"CVE-2026-86773","cvss":5.4,"epss":0.0025,"slug":"cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints","title":"Snipe-IT broken access control in Predefined Kit endpoints","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:28.04+00:00","url":"https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints"},{"cve":"CVE-2026-86772","cvss":5.4,"epss":0.0025,"slug":"cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names","title":"Snipe-IT stored cross-site scripting in department names","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:27.89+00:00","url":"https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names"},{"cve":"CVE-2026-86771","cvss":7.6,"epss":0.0032,"slug":"cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped","title":"Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:27.74+00:00","url":"https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped"},{"cve":"CVE-2026-86770","cvss":8.1,"epss":0.0057,"slug":"cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation","title":"Snipe-IT authentication bypass in SAML username collation","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:27.593+00:00","url":"https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation"},{"cve":"CVE-2026-86769","cvss":4.3,"epss":0.0028,"slug":"cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout","title":"Snipe-IT improper ownership management in consumables checkout API","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:27.447+00:00","url":"https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout"},{"cve":"CVE-2026-86768","cvss":5.4,"epss":0.0035,"slug":"cve-2026-86768-snipe-it-api-checkout-endpoints-improper-input-validation","title":"Snipe-IT API checkout endpoints improper input validation","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:27.307+00:00","url":"https://junglewise.ai/threats/cve-2026-86768-snipe-it-api-checkout-endpoints-improper-input-validation"},{"cve":"CVE-2026-86767","cvss":5,"epss":0.0033,"slug":"cve-2026-86767-snipe-it-unauthorized-cross-company-read-in-requested-assets","title":"Snipe-IT unauthorized cross-company read in requested assets","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:27.133+00:00","url":"https://junglewise.ai/threats/cve-2026-86767-snipe-it-unauthorized-cross-company-read-in-requested-assets"},{"cve":"CVE-2026-86766","cvss":6.5,"epss":0.0035,"slug":"cve-2026-86766-snipe-it-consumable-checkout-race-condition","title":"Snipe-IT consumable checkout race condition","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:26.963+00:00","url":"https://junglewise.ai/threats/cve-2026-86766-snipe-it-consumable-checkout-race-condition"},{"cve":"CVE-2026-86765","cvss":6.5,"epss":0.0041,"slug":"cve-2026-86765-snipe-it-authorization-bypass-in-asset-update-endpoint","title":"Snipe-IT authorization bypass in asset update endpoint","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:26.78+00:00","url":"https://junglewise.ai/threats/cve-2026-86765-snipe-it-authorization-bypass-in-asset-update-endpoint"},{"cve":"CVE-2026-86764","cvss":6.5,"epss":0.0037,"slug":"cve-2026-86764-snipe-it-permission-bypass-in-assigned-components-endpoint","title":"Snipe-IT permission bypass in assigned components endpoint","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:26.597+00:00","url":"https://junglewise.ai/threats/cve-2026-86764-snipe-it-permission-bypass-in-assigned-components-endpoint"},{"cve":"CVE-2026-86763","cvss":3.5,"epss":0.0027,"slug":"cve-2026-86763-snipe-it-livewire-importer-authorization-bypass","title":"Snipe-IT Livewire importer authorization bypass","severity":"low","exploited":false,"published_at":"2026-09-09T14:17:26.407+00:00","url":"https://junglewise.ai/threats/cve-2026-86763-snipe-it-livewire-importer-authorization-bypass"},{"cve":"CVE-2026-86762","cvss":8.1,"epss":0.0047,"slug":"cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens","title":"Snipe-IT authentication bypass via deactivated user API tokens","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:26.22+00:00","url":"https://junglewise.ai/threats/cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens"},{"cve":"CVE-2026-86761","cvss":4.3,"epss":0.0036,"slug":"cve-2026-86761-snipe-it-authorization-bypass-in-location-print-endpoints","title":"Snipe-IT authorization bypass in location print endpoints","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:25.99+00:00","url":"https://junglewise.ai/threats/cve-2026-86761-snipe-it-authorization-bypass-in-location-print-endpoints"},{"cve":"CVE-2026-86760","cvss":5.4,"epss":0.0038,"slug":"cve-2026-86760-snipe-it-authorization-bypass-in-user-account-activation-toggle","title":"Snipe-IT authorization bypass in user account activation toggle","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:25.8+00:00","url":"https://junglewise.ai/threats/cve-2026-86760-snipe-it-authorization-bypass-in-user-account-activation-toggle"},{"cve":"CVE-2026-86759","cvss":7.1,"epss":0.0037,"slug":"cve-2026-86759-snipe-it-missing-authorization-in-asset-history-csv-importer","title":"Snipe-IT missing authorization in asset-history CSV importer","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:25.593+00:00","url":"https://junglewise.ai/threats/cve-2026-86759-snipe-it-missing-authorization-in-asset-history-csv-importer"},{"cve":"CVE-2026-86758","cvss":6.5,"epss":0.0041,"slug":"cve-2026-86758-snipe-it-authorization-bypass-in-license-key-export","title":"Snipe-IT authorization bypass in license key export","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:25.43+00:00","url":"https://junglewise.ai/threats/cve-2026-86758-snipe-it-authorization-bypass-in-license-key-export"},{"cve":"CVE-2026-86757","cvss":6.5,"epss":0.0037,"slug":"cve-2026-86757-snipe-it-authorization-bypass-in-encrypted-custom-field-form","title":"Snipe-IT authorization bypass in encrypted custom field form rendering","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:25.17+00:00","url":"https://junglewise.ai/threats/cve-2026-86757-snipe-it-authorization-bypass-in-encrypted-custom-field-form"},{"cve":"CVE-2026-86756","cvss":6.1,"epss":0.0033,"slug":"cve-2026-86756-snipe-it-open-redirect-in-saml-relaystate-parameter","title":"Snipe-IT open redirect in SAML RelayState parameter","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:24.883+00:00","url":"https://junglewise.ai/threats/cve-2026-86756-snipe-it-open-redirect-in-saml-relaystate-parameter"},{"cve":"CVE-2026-86755","cvss":5.4,"epss":0.0027,"slug":"cve-2026-86755-snipe-it-permission-bypass-in-passport-personal-access-token","title":"Snipe-IT permission bypass in Passport personal-access-token routes","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:24.737+00:00","url":"https://junglewise.ai/threats/cve-2026-86755-snipe-it-permission-bypass-in-passport-personal-access-token"},{"cve":"CVE-2026-86754","cvss":7.3,"epss":0.0034,"slug":"cve-2026-86754-snipe-it-authorization-bypass-in-oauth-client-management","title":"Snipe-IT authorization bypass in OAuth client management","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:24.59+00:00","url":"https://junglewise.ai/threats/cve-2026-86754-snipe-it-authorization-bypass-in-oauth-client-management"},{"cve":"CVE-2026-86753","cvss":4.3,"epss":0.0028,"slug":"cve-2026-86753-snipe-it-business-logic-bypass-in-asset-model-request-endpoint","title":"snipe-it business logic bypass in asset model request endpoint","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:24.447+00:00","url":"https://junglewise.ai/threats/cve-2026-86753-snipe-it-business-logic-bypass-in-asset-model-request-endpoint"},{"cve":"CVE-2026-86752","cvss":5.4,"epss":0.0025,"slug":"cve-2026-86752-snipe-it-asset-audit-endpoints-authorization-bypass","title":"snipe-it asset audit endpoints authorization bypass","severity":"medium","exploited":false,"published_at":"2026-09-09T14:17:24.307+00:00","url":"https://junglewise.ai/threats/cve-2026-86752-snipe-it-asset-audit-endpoints-authorization-bypass"},{"cve":"CVE-2026-86751","cvss":8.5,"epss":0.0037,"slug":"cve-2026-86751-snipe-it-markdown-image-injection-in-mail-notifications","title":"Snipe-IT markdown image injection in mail notifications","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:24.17+00:00","url":"https://junglewise.ai/threats/cve-2026-86751-snipe-it-markdown-image-injection-in-mail-notifications"},{"cve":"CVE-2026-86750","cvss":7.7,"epss":0.0033,"slug":"cve-2026-86750-snipe-it-authorization-bypass-in-user-rest-api","title":"Snipe-IT authorization bypass in user REST API","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:24.03+00:00","url":"https://junglewise.ai/threats/cve-2026-86750-snipe-it-authorization-bypass-in-user-rest-api"}],"vendor":{"hub":true,"name":"Snipeitapp","slug":"snipeitapp","homepage":"https://snipeitapp.com/","description":"Snipe IT is the developer of an open-source IT asset management system.","url":"https://junglewise.ai/threats/vendors/snipeitapp"},"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":42},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-37709","cvss":9.8,"epss":0.0079,"slug":"cve-2026-37709-grokability-snipe-it-insecure-permissions-in","title":"Grokability Snipe-IT insecure permissions in UploadedFilesController","severity":"critical","exploited":false,"published_at":"2026-05-07T18:16:19.013+00:00","url":"https://junglewise.ai/threats/cve-2026-37709-grokability-snipe-it-insecure-permissions-in"},{"cve":"CVE-2026-85617","cvss":8.8,"epss":0.0048,"slug":"cve-2026-85617-snipe-it-authorization-bypass-in-bulk-delete","title":"snipe-it authorization bypass in bulk delete","severity":"high","exploited":false,"published_at":"2026-09-04T12:17:25.41+00:00","url":"https://junglewise.ai/threats/cve-2026-85617-snipe-it-authorization-bypass-in-bulk-delete"},{"cve":"CVE-2026-86738","cvss":8.7,"epss":0.0049,"slug":"cve-2026-86738-snipe-it-css-injection-in-custom-css-field","title":"Snipe-IT CSS injection in custom CSS field","severity":"high","exploited":false,"published_at":"2026-09-08T16:18:36.98+00:00","url":"https://junglewise.ai/threats/cve-2026-86738-snipe-it-css-injection-in-custom-css-field"},{"cve":"CVE-2026-85616","cvss":8.5,"epss":0.0038,"slug":"cve-2026-85616-snipe-it-authorization-bypass-in-checkout-acceptance-report","title":"Snipe-IT authorization bypass in checkout-acceptance report","severity":"high","exploited":false,"published_at":"2026-09-04T12:17:25.27+00:00","url":"https://junglewise.ai/threats/cve-2026-85616-snipe-it-authorization-bypass-in-checkout-acceptance-report"},{"cve":"CVE-2026-86751","cvss":8.5,"epss":0.0037,"slug":"cve-2026-86751-snipe-it-markdown-image-injection-in-mail-notifications","title":"Snipe-IT markdown image injection in mail notifications","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:24.17+00:00","url":"https://junglewise.ai/threats/cve-2026-86751-snipe-it-markdown-image-injection-in-mail-notifications"},{"cve":"CVE-2026-86741","cvss":8.5,"epss":0.0035,"slug":"cve-2026-86741-snipe-it-arbitrary-file-read-and-ssrf-via-category-eula","title":"Snipe-IT arbitrary file read and SSRF via category EULA","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:22.68+00:00","url":"https://junglewise.ai/threats/cve-2026-86741-snipe-it-arbitrary-file-read-and-ssrf-via-category-eula"},{"cve":"CVE-2026-86770","cvss":8.1,"epss":0.0057,"slug":"cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation","title":"Snipe-IT authentication bypass in SAML username collation","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:27.593+00:00","url":"https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation"},{"cve":"CVE-2026-86762","cvss":8.1,"epss":0.0047,"slug":"cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens","title":"Snipe-IT authentication bypass via deactivated user API tokens","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:26.22+00:00","url":"https://junglewise.ai/threats/cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens"},{"cve":"CVE-2026-86750","cvss":7.7,"epss":0.0033,"slug":"cve-2026-86750-snipe-it-authorization-bypass-in-user-rest-api","title":"Snipe-IT authorization bypass in user REST API","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:24.03+00:00","url":"https://junglewise.ai/threats/cve-2026-86750-snipe-it-authorization-bypass-in-user-rest-api"},{"cve":"CVE-2026-86771","cvss":7.6,"epss":0.0032,"slug":"cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped","title":"Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num","severity":"high","exploited":false,"published_at":"2026-09-09T14:17:27.74+00:00","url":"https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped"}],"generated_at":"2026-09-28T03:07:00.154823+00:00","technologies":[{"name":"Snipeitapp Snipe-It","slug":"snipe-it","vulnerabilities":89,"url":"https://junglewise.ai/threats/technologies/snipe-it"}]}