EUVD-2026-74929

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86752

snipe-it versions before 8.7.0 contain an authorization bypass in their asset audit endpoints . The root cause is a failure to enforce per-instance FMCS scoping at the policy layer, relying solely on query-layer filtering for isolation. An attacker with a valid session and assets.audit permission...

CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

EUVD-2026-74921

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744

Snipe-IT (8.6.3 and earlier) is affected by a race condition in its asset checkout paths. The methods Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without a row lock or r...

CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

EUVD-2026-74920

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

CVE-2026-86743

Snipe-IT versions before 8.7.0 contain an authorization bypass in the asset acceptance report functionality. The root cause is a failure to properly scope asset acceptance report queries by company, allowing authenticated users with the reports.view permission to read pending acceptances across a...

CVE-2026-86742

Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the search asset preview feature. The root cause is a failure to escape indexed asset content before inserting it into the DOM via innerHTML . An attacker who can place crafted text assets in a workspace can ...

EUVD-2026-74840

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87813

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Search Assets result list , where asset filenames are interpolated into HTML without proper escaping. An authenticated attacker can craft asset filenames containing malicious markup that executes JavaScri...