CVE-2026-54743: Improper Neutralization of Input During Web Page Generation

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-61807: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-55703: Missing Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

CVE-2026-55694: Authorization Bypass Through User-Controlled Key

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/targetid/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/filename. The primary /stored-eula-file/filename rout...

CVE-2026-55643: Incorrect Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

CVE-2026-50550: Incorrect Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset. The endpoint authorizes update access but does not enforce canEditAuthFiel...

CVE-2026-49870: Allocation of Resources Without Limits or Throttling

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-55483: Missing Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-49976: Incorrect Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-55519: Improper Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

CVE-2026-55482: Authorization Bypass Through User-Controlled Key

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

PT-2026-78577

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where any activated account can access maintenance records for assets within the same company without requiring specific asset or maintenance permissions. This occurs because the sho...

PT-2026-80266

Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded...

PT-2026-78575

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where a company-scoped user in FMCS floater mode can access users with a null company id because the isCurrentUserHasAccess check is not consistently applied during broad API queries...

PT-2026-80265

Impact Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company company id = null. While direct instance authorization isCurrentUserHasAccess correctly denies access to these out-of-scope...

An Emulation Anchored Digital Twin Testbed for Cyberattack and Defense Analysis in Hospital IT OT Environments

Modern hospitals increasingly rely on integrated Information Technology IT and Operational Technology OT infrastructures to support critical healthcare services. However, this convergence expands the cybersecurity attack surface and makes safe validation of defensive mechanisms difficult on live...

Security Bulletin: linkify-it-5.0.1.tgz security vulnerability in Content Cortex(CCx) reported for GenAI ICN Plugin

Summary linkify-it-5.0.1.tgz CVE-2026-59887 security vulnerability in Content CortexCCx reported for GenAI ICN Plugin Vulnerability Details CVEID:CVE-2026-59887 DESCRIPTION: linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...