snipe has 12 CVEs on record between 2022 and 2026. Cadence is steady at roughly 6 per quarter. The busiest recent month was August 2026 with 6. The median CVSS is 7.1 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (4) and CWE-862 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 6 prev 5
Worst active — by depth score
CVE-2022-23064High· 8.8snipe-IT vulnerable to host header injection49CVE-2026-54329High· 8.5Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection47CVE-2026-55516High· 7.7Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update42CVE-2026-55460High· 7.1Snipe-IT has an authorization bypass on bulk editing users39CVE-2026-48507High· 7.1Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users39
snipe vulnerabilities
CVEs affecting snipe, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-55843High· 6.5Snipe-IT has an Improper Privilege Management issue
Snipe-IT has an Improper Privilege Management issue
CVE-2026-55460High· 7.1Snipe-IT has an authorization bypass on bulk editing users
Snipe-IT has an authorization bypass on bulk editing users
CVE-2026-55464Medium· 5.4Snipe-IT vulnerable to stored XSS via Markdown custom field
Snipe-IT vulnerable to stored XSS via Markdown custom field
CVE-2026-55472Medium· 4.3Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
CVE-2026-55476MediumSnipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
CVE-2026-55516High· 7.7Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
CVE-2026-48492MediumSnipe-IT's selectlist visibility is too permissive
Snipe-IT's selectlist visibility is too permissive
CVE-2026-48493Medium· 5.5Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
CVE-2026-48507High· 7.1Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
CVE-2026-55542LowSnipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
CVE-2026-54329High· 8.5Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
CVE-2022-23064High· 8.8snipe-IT vulnerable to host header injection
snipe-IT vulnerable to host header injection