EUVD-2026-62680

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-55483

In Snipe-IT versions prior to 8.6.0, the store() method in UsersController.php strips the superuser permission but fails to strip the admin permission, allowing any authenticated user with the users.create permission to create accounts with full administrative privileges. The fix is included in v...

CVE-2026-55483 Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-59887

A flaw was found in linkify-it, a library for recognizing links. A remote attacker could exploit this vulnerability by providing specially crafted user text. The mailto: schema validator, when processing this input, can be repeatedly invoked, leading to excessive CPU consumption. This can result ...

CVE-2026-50550 Snipe-IT: 2FA reset privilege bypass

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset. The endpoint authorizes update access but does not enforce canEditAuthFiel...

CVE-2026-50550

CVE-2026-50550 is a missing authorization vulnerability in Snipe-IT , an IT asset and license management system built on Laravel, affecting versions prior to 8.5.0 . The postTwoFactorReset() endpoint in app/Http/Controllers/Api/UsersController.php checks for general update access but fails to enf...

CVE-2026-50550 Snipe-IT: 2FA reset privilege bypass

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, a user who can edit other users can reset a superadmin's two-factor authentication through app/Http/Controllers/Api/UsersController.php postTwoFactorReset. The endpoint authorizes update access but does not enforce canEditAuthFiel...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-49870

In Snipe-IT before v8.6.0, the POST /two-factor endpoint lacked rate limiting, lockout, or attempt counters, allowing an attacker with valid credentials to brute-force TOTP codes (3 of 1,000,000 accepted due to window=1). A successful guess grants a full authenticated session. In optional 2FA mod...

CVE-2026-49870 Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by config/google2fa.php window=1. A successf...

CVE-2026-49976

Snipe-IT (IT asset/license management system) prior to 8.6.1 is vulnerable to account takeover via CSV import . A user with only the import permission can upload a CSV in update mode to overwrite a non-admin user's email address, then trigger a password reset to seize that account. The root cause...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-49976 Snipe-IT: User Account Escalation via CSV Import

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

EUVD-2026-62675

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, a user with the import permission can use CSV update mode to overwrite the email address of a non-admin user and then request a password reset to take over that account. app/Importer/UserImporter.php applies the canEditAuthFields...

CVE-2026-70834

creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:51+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70885

creationtimestamp| type| source ---|---|--- 2026-08-19 17:47:15+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-61291

creationtimestamp| type| source ---|---|--- 2026-08-19 17:21:51+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-61118

creationtimestamp| type| source ---|---|--- 2026-08-19 17:19:04+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-23 01:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtpno5zsu52u...