7648 matches found
CVE-2026-84206
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
CVE-2026-84206
Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...
CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...
CVE-2026-48988
A flaw was found in markdown-it, a Markdown parser. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS when the typographer option is enabled. This occurs due to inefficient processing of smartquotes, leading to excessive CPU consumption when parsing specially...
EUVD-2026-42985
Snipe-IT has an Improper Privilege Management issue...
EUVD-2026-42984
Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update...
EUVD-2026-42995
Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...
EUVD-2026-43003
Snipe-IT has CSS Injection via headercolor Setting...
EUVD-2026-42998
Snipe-IT has incorrect permission for legacy license checkin API...
EUVD-2026-42986
Snipe-IT has missing object-level authorization in Kits API...
EUVD-2026-42989
Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancelbyadmin Parameter...
EUVD-2026-43001
Snipe-IT's import createdby can be overwritten...
EUVD-2026-42983
Snipe-IT vulnerable to directory traversal in displaySig...
EUVD-2026-42990
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation...
EUVD-2026-43000
Snipe-IT has a path traversal vulnerability via CSV import image field...
EUVD-2026-42996
Snipe-IT vulnerable to stored XSS via inline-served attachment...