CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin versions before 3.0.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to properly escape a value from an incoming request before outputting it into an inline JavaScript event ha...

[SECURITY] Fedora 44 Update: python-linkify-it-py-2.1.1-1.fc44

This is a Python port of linkify-it 1, a link recognition library with FULL unicode support. It is focused on high quality link pattern detection in plain text. See a JavaScript demo 2. References: 1 https://github.com/markdown-it/linkify-it 2 https://markdown-it.github.io/linkify-it/...

Fedora 44 : python-linkify-it-py (2026-7c23b06d74)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7c23b06d74 advisory. Security release: LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. - Fix quadratic complexity in...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the bulk asset restore process. An attacker can restore previously soft-deleted assets by submitting asset identifiers to the affected endpoint,...

CVE-2026-84206

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

EUVD-2026-69294

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

ROOT-APP-NPM-CVE-2026-48801 CVE-2026-48801 in linkify-it - Patched by Root

Root has patched CVE-2026-48801 in the linkify-it package for Root:npm. Multiple fixed versions available...

PT-2026-84304

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206: Incorrect Authorization

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...

CVE-2026-48988

A flaw was found in markdown-it, a Markdown parser. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS when the typographer option is enabled. This occurs due to inefficient processing of smartquotes, leading to excessive CPU consumption when parsing specially...

Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

EUVD-2026-42985

Snipe-IT has an Improper Privilege Management issue...

GHSA-J5G3-42WP-GQM3 Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

CVE-2026-55515

creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:33+00:00| published-proof-of-concept| https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg...

GHSA-575R-357H-FHCH Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

Impact The API endpoint for updating asset maintenance records allows an authorized user to change the assetid of an existing maintenance record to an asset outside their company scope. In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or...