Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the bulk asset restore process. An attacker can restore previously soft-deleted assets by submitting asset identifiers to the affected endpoint,...

CVE-2026-84206

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

CVE-2026-84206 Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

EUVD-2026-69294

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator...

EUVD-2026-42991

Snipe-IT has an authorization bypass on bulk editing users...

GHSA-VGX7-C78R-69W9 Snipe-IT has an authorization bypass on bulk editing users

Impact An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update. Attacker Model...

Snipe-IT has an authorization bypass on bulk editing users

Impact An authenticated non-admin user with users.view and users.edit, but without users.delete, can directly POST to /users/bulksave and soft-delete another non-admin user. The UI and confirmation route require users.delete, but the destructive sink only authorizes update. Attacker Model...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098967)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098967 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6selectpath under high next hop churn Soft lockups have been observe...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098984)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098984 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move waitonsem out of spinlock With iommu.strict=1, the existing completion wait path...

SUSE CVE-2026-74411

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: Correct data type for scan index to avoid infinite loop A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU becomes stuck in rtw89hwscanaddchanax for over 20 seconds, leading to a system...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: rtw89: Correct data type for the scan index to avoid infinite loops. A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band. The CPU became stuck in rtw89hwscanaddchanax for over 20 seconds, leading to ...

A Study of Bluetooth Access Control Based on NFT Soft Pairing

This paper proposes a Non-Fungible Token NFT soft pairing framework for Bluetooth service access control. Unlike conventional Bluetooth systems where pairing implicitly grants persistent service access, the proposed approach decouples native Bluetooth pairing from authorization without modifying...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102108)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102108 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-up...

CVE-2026-74411

A flaw was found in the Linux kernel's rtw89 Wi-Fi driver. An incorrect data type used for a scan index during Wi-Fi scanning on the 6GHz band can lead to an infinite loop. This can cause a kernel soft lockup, making the CPU unresponsive and ultimately leading to a system panic, effectively...

CVE-2026-74345

A flaw was found in the Linux kernel's Soft iWARP siw component, which handles high-performance data transfer. This vulnerability occurs when the system processes a specially crafted connection request, leading to a 'use-after-free' error. An attacker could exploit this to cause a denial of servi...

CVE-2026-74335

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. This vulnerability occurs in the bpftaskfromvpid function when a cgroupskb program, running in a soft interrupt, attempts to look up a task that is in the process of exiting. If the task's process ID PID namespace is...

Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Impact Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company companyid = null. While direct instance authorization isCurrentUserHasAccess correctly denies access to these out-of-scope...

CVE-2026-55643: Incorrect Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

Linux Distros Unpatched Vulnerability : CVE-2026-72193

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs3: cap RESTARTTABLE free-chain walker at rt-used A crafted NTFS3 disk image triggers an in-kernel infinite loop at mount time, hanging the mounting thread...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100111)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100111 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Resolve soft lockup issue when opening /dev/sgX The parameter defreservedsize defines t...