PT-2026-98143

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description A user with the customfields.create permission can store malicious markup in the CustomField.name variable. The app/Presenters/AssetPresenter.php file assigns this value as an unescaped...

CVE-2026-63498: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

CVE-2026-63493: Authentication Bypass Using an Alternate Path or Channel

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

PT-2026-98144

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An issue exists where the CheckForTwoFactor middleware is enforced in the web middleware group but not in the API middleware group. This allows a user who has authenticated with a password but has n...

CVE-2026-62368: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page...

PT-2026-98145

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with file-management access can upload malicious XML and XSLT Extensible Stylesheet Language Transformations attachments. The API endpoint 'GET /api/v1/object type/id/files/fil...

CLSA-2026-1790161417 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.2...

ROOT-APP-NPM-AIKIDO-2026-549894 AIKIDO-2026-549894 in markdown-it - Patched by Root

Root has patched AIKIDO-2026-549894 in the markdown-it package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-21670 CVE-2022-21670 in markdown-it - Patched by Root

Root has patched CVE-2022-21670 in the markdown-it package for Root:npm. Multiple fixed versions available...

WordPress wpShopGermany IT-RECHT KANZLEI plugin 1.6-2.3 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Naoki Kawahigashi in WordPress Plugin wpShopGermany IT-RECHT KANZLEI versions 1.6-2.3...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795

The wpShopGermany IT-RECHT KANZLEI WordPress plugin (versions before 2.4 ) contains a vulnerability where it fails to generate API authentication tokens securely. The plugin derives these tokens from data controlled by the requester and creates them as a side effect of the validation check. This ...

EUVD-2026-81347

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795 wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

CVE-2026-88795: Improper Control of Generation of Code

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the tok...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-41115 DESCRIPTION: An improper authorization vulnerability has been identified in Apache Kafka. The...

CLSA-2026-1789374715 TuxCare security update for markdown-it (1 CVE)

TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 4.4.0-tuxcare.1...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the PredefinedKitCheckoutService process. An attacker can assign assets, licenses, consumables, or accessories from one company to a user in anoth...

CVE-2026-88894

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...