Security: grokability/snipe-it
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Predefined kit checkout bypasses FMCS company isolationGHSA-g7jx-p4xf-m777 published
Aug 26, 2026 by snipeModerate -
Authenticated remote code execution through MariaDB client commands in backup restoreGHSA-x53f-48vj-c5fc published
Aug 24, 2026 by snipeHigh -
Resource-Exhaustion DoS via Unbounded Acceptance Note Reaching Synchronous CommonMark RenderingGHSA-4vcv-fc5x-jjwv published
Aug 24, 2026 by snipeModerate -
IPv6 transition address bypass of webhook URL SSRF guardGHSA-5j6m-rr83-rpj7 published
Aug 24, 2026 by snipeModerate -
Checkout Requests and Cancellations - duplicate submissions increment more than onceGHSA-hc9q-5x9h-9gxc published
Aug 24, 2026 by snipeModerate -
`GET /hardware/{asset}/barcode` renders any asset's barcode PNG for any authenticated user regardless of `assets.view` or FMCS scope.GHSA-6f4g-phw5-4g77 published
Aug 24, 2026 by snipeModerate -
Cross-superuser CSRF-token exfiltration via custom CSS `@import` and external `url()`GHSA-pvcw-mp8q-mj39 published
Aug 24, 2026 by snipeHigh -
Acceptance Finalizes Without Stored Evidence Under Silent Storage FailureGHSA-h543-58f9-v6mj published
Aug 24, 2026 by snipeModerate -
Attachment Deletion Reports Success While File Remains on DiskGHSA-4c4h-cpgf-h4qr published
Aug 24, 2026 by snipeLow -
Arbitrary Local File Read and SSRF via Category EULA Rendered in Checkout MailGHSA-qmhc-p47c-6x75 published
Aug 24, 2026 by snipeCritical