CVE-2026-86752

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86744

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

EUVD-2026-74946

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

CVE-2026-86769 Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission...

CVE-2026-86769

Snipe-IT versions before 8.7.0 contain an improper ownership management flaw in the consumables checkout API endpoint . The endpoint records the target user's ID in the created_by column instead of the authenticated caller's ID , causing misattributed audit entries in the consumables_users pivot ...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

EUVD-2026-74936

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759

Snipe-IT versions before 8.7.0 are affected by a missing authorization flaw in the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets across companies and inject fraudulent audit trail entries , compromising inventory integrity and accountab...

EUVD-2026-74929

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86752 snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company...

CVE-2026-86752

snipe-it versions before 8.7.0 contain an authorization bypass in their asset audit endpoints . The root cause is a failure to enforce per-instance FMCS scoping at the policy layer, relying solely on query-layer filtering for isolation. An attacker with a valid session and assets.audit permission...

CVE-2026-86744 snipe-it before 8.7.0 Race Condition in Asset Checkout

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

EUVD-2026-74921

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-86744

Snipe-IT (8.6.3 and earlier) is affected by a race condition in its asset checkout paths. The methods Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without a row lock or r...

halo-record v0.2.42

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your agent takes tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only, hash-chained log; the...

CVE-2026-33920

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

CVE-2026-33920

CVE-2026-33920 affects the login functionality of Nozomi Networks Guardian/CMC (versions before 26.3.0 ). The root cause is a missing validation of the anti-CSRF token in both standard and SAML login flows. An attacker holding a valid account can coerce a victim into unknowingly authenticating wi...

CVE-2026-33920 Cross-site request forgery in the Guardian/CMC login before 26.3.0

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...

EUVD-2026-72789

A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any operation performe...