ROOT-APP-MAVEN-CVE-2026-43512 CVE-2026-43512 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43512 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-53506 CVE-2025-53506 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-53506 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41293 CVE-2026-41293 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-41293 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43514 CVE-2026-43514 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43514 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-29129 CVE-2026-29129 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-29129 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-24734 CVE-2026-24734 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-24734 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34500 CVE-2026-34500 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-34500 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-32990 CVE-2026-32990 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-32990 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-25854 CVE-2026-25854 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-25854 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34486 CVE-2026-34486 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-34486 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

External Control of File Name or Path

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to External Control of File Name or Path via improper sanitization of markdown image syntax in note fields. An attacker can access sensitive server files and perform unauthoriz...

CVE-2026-86751

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86741

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

EUVD-2026-74928

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86751

Snipe-IT versions before 8.7.0 fail to properly sanitize markdown image syntax in note fields. An authenticated attacker can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, get expanded by the CommonMark parser , and are then resolved by laravel-mail-auto-emb...

CVE-2026-86751 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...

CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

EUVD-2026-74918

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...