Product by Grokability
Snipe-IT
135 known vulnerabilities in Snipe-IT (Grokability), 0 of them actively exploited (CISA KEV).
Key figures
135
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-86733 | Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore | 7.2 | |
| High | CVE-2026-86770 | Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation | 8.1 | |
| Critical | CVE-2026-86738 | Snipe-IT before 8.7.0 CSS Injection via Custom CSS | 8.7 | |
| Critical | CVE-2026-37709 | Snipe-IT: Code Execution | 9.8 | |
| High | CVE-2022-23064 | Snipe-IT - Host Header Injection | 8.8 | |
| High | CVE-2026-85617 | snipe-it before 8.6.3 Authorization Bypass via Bulk Delete | 8.8 | |
| High | CVE-2026-86762 | Snipe-IT before 8.7.0 Authentication Bypass via API Middleware | 8.1 | |
| Critical | CVE-2025-63601 | Snipe-IT: Remote Code Execution | 9.9 | |
| Critical | CVE-2026-116199 | Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback | 8.1 | |
| High | CVE-2026-86734 | Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field | 6.5 | |
| High | CVE-2026-116201 | Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition | 8.8 | |
| High | CVE-2026-63493 | Snipe-IT: 2FA bypass via the API token flow | 8.1 | |
| High | CVE-2026-62368 | Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | 8.1 | |
| Critical | CVE-2026-86751 | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown | 8.5 | |
| High | CVE-2026-85616 | Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance | 8.5 | |
| High | CVE-2026-55466 | Snipe-IT: Stored XSS via inline-served attachment | 8.7 | |
| High | CVE-2026-86741 | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA | 8.5 | |
| High | CVE-2026-86754 | Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients | 7.3 | |
| High | CVE-2026-63498 | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | 8.7 | |
| High | CVE-2026-55483 | Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation | 8.8 | |
| Medium | CVE-2025-47226 | Snipe-IT: Forced Browsing | 5.0 | |
| High | CVE-2026-86750 | snipe-it before 8.7.0 Authorization Bypass via API User Create/Update | 7.7 | |
| Critical | CVE-2022-1380 | Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it | 9.1 | |
| High | CVE-2026-86771 | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num | 7.6 | |
| High | CVE-2025-15602 | Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation | 8.8 |