CVE-2026-86742

Snipe-IT versions through 8.6.3 are vulnerable to CSV formula injection via the unaccepted assets acceptance report export. The ReportsController::postAssetAcceptanceReport method builds the CSV by hand without applying League\Csv\EscapeFormula or honoring the app.escape_formulas config, unlike s...

CVE-2026-86742 Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

CVE-2026-87814

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the search asset preview feature. The root cause is a failure to escape indexed asset content before inserting it into the DOM via innerHTML . An attacker who can place crafted text assets in a workspace can ...

CVE-2026-87813

SiYuan before v3.8.2 is affected by a stored cross-site scripting (XSS) vulnerability in the Search Assets result list , where asset filenames are interpolated into HTML without proper escaping. An authenticated attacker can craft asset filenames containing malicious markup that executes JavaScri...

EUVD-2026-74840

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

CVE-2026-87814 SiYuan before v3.8.2 Stored XSS via Asset Preview

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content before inserting it into the DOM using innerHTML. Attackers who can place crafted text assets in a workspace can execute JavaScript in the SiYua...

PT-2026-88952

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2 Description A stored cross-site scripting issue exists in the search asset preview feature. The application fails to escape indexed asset content before inserting it into the Document Object Model DOM using the...

PT-2026-89013

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description A race condition exists in the asset checkout paths. The functions ApiAssetsController::checkout and AssetsAssetCheckoutController::store call Asset::availableForCheckout outside the mutation path a...

PT-2026-89034

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/id'...

PT-2026-89026

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read...

PT-2026-89022

Name of the Vulnerable Software and Affected Versions snipe-it versions prior to 8.7.0 Description Authenticated users can bypass administrative restrictions to create checkout requests for asset models that are not marked as requestable. This occurs because the application fails to validate the...

PT-2026-89021

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

PT-2026-89028

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authorization failure exists in the 'POST /hardware/history' endpoint, which allows any authenticated user to reassign arbitrary assets and modify audit logs. By submitting a CSV file, an attacke...

CVE-2026-86768: Improper Input Validation

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted use...

CVE-2026-86765: Missing Authorization

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86752: Incorrect Authorization

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...