VulnCheck KEV: CVE-2026-42016

JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: OSV:GHSA-JQHH-CJMQ-VMV6...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: SNYK:PYTHON-OPENWEBUI-20158686...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-88002 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-88002 Source advisory: MEND:CVE-2026-88002...

hubzoid (>=0.7.15, <=0.9.6), openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-87999 via open-webui (>=0.6.0, <=0.11.0)

open-webui PYPI version =0.6.0, =0.7.15, =0.9.6 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-87999 Source advisory: MEND:CVE-2026-87999...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the oauth/personal-access-tokens routes, which are exposed with insufficient middleware protections. An attacker can obtain a long-lived bearer...

CVE-2026-86762

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

EUVD-2026-74939

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762

Snipe-IT before 8.7.0 is vulnerable to an authentication bypass via its API middleware. The CheckUserIsActivated middleware is not applied to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke existing Passport personal access tokens . A deactivated account t...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (/oauth/personal-access-tokens*) with only the web and auth:web middleware, lacking the self.api permission gate that Snipe-IT enforces on its own token endpoints. Any user with a valid we...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-86754

Snipe-IT versions prior to 8.7.0 fail to properly gate Laravel Passport's OAuth client management routes , allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. An attacker can trick an administrator into approving a consent screen, then exchange the re...

EUVD-2026-74932

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...