Snipeitapp has 64 CVEs on record. Disclosure cadence is accelerating: 60 in the last 90 days against 3 in the 90 before. The busiest recent month was September 2026 with 49. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (14) and CWE-862 (10). Most affected products: snipe-it (64), IT Open Source Asset Management (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 60 prev 3
Weakness classes
Products
- snipe-it 64
- IT Open Source Asset Management 1
Worst active — by depth score
CVE-2025-15602High· 8.8Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment61CVE-2026-63498High· 8.7Snipe-IT is an IT asset/license management system60CVE-2026-86751High· 8.5Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests59CVE-2026-86741High· 8.5Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails59CVE-2026-62368High· 8.1Snipe-IT is an IT asset/license management system57
Snipeitapp vulnerabilities
CVEs affecting Snipeitapp, newest first. Open any entry for full detail, references, and exploit status.
65 CVEsRSS
CVE-2026-55478Medium· 5.4Snipe-IT is an IT asset/license management system
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not authorize access to the referenced license object, allowing a low-privilege user …
CVE-2026-55474Medium· 6.5Snipe-IT is an IT asset/license management system
Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to…
CVE-2026-44832High· 8.8Snipe-IT is an IT asset/license management system
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]…
CVE-2025-15602High· 8.8PoCSnipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify…
CVE-2019-25264Medium· 6.4PoCSnipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags to execute arbitrary JavaScript w…