CVE-2026-86747

Snipe-IT is an open-source IT asset management system. In versions up to and including 8.6.3 , when Full Multiple Company Support (FMCS) is enabled, the authorization guard in ReportsController::currentUserCanAccessAcceptance() early-returns true for pivot-only users (whose users.company_id colum...

EUVD-2026-74924

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

SUSE CVE-2025-47281

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

CVE-2025-47281: Improper Input Validation

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service DoS vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via improper handling of JMESPath variable substitutions in the getValueAsStringMap function within pkg/engine/wildcards/wildcards.go. An attacker can cause the admission controller and reports controller to crash by...