CVEs we hold for Grokability
Records whose assigning authority named Grokability as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-88894Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkoutgrokability snipe-it CVE-2026-86774Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicygrokability snipe-it CVE-2026-86773Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpointsgrokability snipe-it CVE-2026-86772Snipe-IT 8.6.3 Stored XSS via Department Namesgrokability snipe-it CVE-2026-86771Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_numgrokability snipe-it CVE-2026-86770Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collationgrokability snipe-it CVE-2026-86769Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkoutgrokability snipe-it CVE-2026-86768Snipe-IT before 8.7.0 Improper Input Validation via API Checkoutgrokability snipe-it CVE-2026-86767Snipe-IT before 8.7.0 Cross-Company Read via requested-assetsgrokability snipe-it CVE-2026-86766Snipe-IT 8.6.3 Race Condition via Consumable Checkoutgrokability snipe-it CVE-2026-86765Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpointgrokability snipe-it CVE-2026-86764Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned componentsgrokability snipe-it CVE-2026-86763snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importergrokability snipe-it CVE-2026-86762Snipe-IT before 8.7.0 Authentication Bypass via API Middlewaregrokability snipe-it CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpointsgrokability snipe-it CVE-2026-86760snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flaggrokability snipe-it CVE-2026-86759Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importergrokability snipe-it CVE-2026-86758Snipe-IT before 8.7.0 License Key Exposure via CSV Exportgrokability snipe-it CVE-2026-86757Snipe-IT before 8.7.0 Information Disclosure via Custom Fieldsgrokability snipe-it CVE-2026-86756Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayStategrokability snipe-it CVE-2026-86755Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuthgrokability snipe-it CVE-2026-86754Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clientsgrokability snipe-it CVE-2026-86753snipe-it before 8.7.0 Business Logic Bypass via asset_model endpointgrokability snipe-it CVE-2026-86752snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpointsgrokability snipe-it CVE-2026-86751Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdowngrokability snipe-it CVE-2026-86750snipe-it before 8.7.0 Authorization Bypass via API User Create/Updategrokability snipe-it CVE-2026-86749snipe-it before 8.7.0 Data Loss via Failed Image Writegrokability snipe-it CVE-2026-86748Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archivegrokability snipe-it CVE-2026-86747snipe-it before 8.7.0 Authorization Bypass via Pivot-Only Usergrokability snipe-it CVE-2026-86746Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replaygrokability snipe-it CVE-2026-86745Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Exportgrokability snipe-it CVE-2026-86744snipe-it before 8.7.0 Race Condition in Asset Checkoutgrokability snipe-it CVE-2026-86743Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Reportgrokability snipe-it CVE-2026-86742Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Reportgrokability snipe-it CVE-2026-86741Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULAgrokability snipe-it CVE-2026-86740Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remainsgrokability snipe-it CVE-2026-86739Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidencegrokability snipe-it CVE-2026-86738Snipe-IT before 8.7.0 CSS Injection via Custom CSSgrokability snipe-it CVE-2026-86737snipe-it before 8.7.0 Missing Authorization via barcode endpointgrokability snipe-it CVE-2026-86736snipe-it before 8.7.0 Checkout Request Counter Integrity Failuregrokability snipe-it CVE-2026-86735snipe-it before 8.7.0 SSRF via IPv6 transition address bypassgrokability snipe-it CVE-2026-86734Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Fieldgrokability snipe-it CVE-2026-86733Snipe-IT before 8.7.0 Remote Code Execution via Backup Restoregrokability snipe-it CVE-2026-85617snipe-it before 8.6.3 Authorization Bypass via Bulk Deletegrokability snipe-it CVE-2026-85616Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptancegrokability snipe-it CVE-2026-84206Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restoregrokability snipe-it CVE-2026-61807Snipe-IT: Stored DOM XSS via table selected-count IDsgrokability snipe-it CVE-2026-55843Snipe-IT: Improper Privilege Managementgrokability snipe-it CVE-2026-55703Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GETgrokability snipe-it CVE-2026-55694Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeovergrokability snipe-it CVE-2026-55643Snipe-IT: Tenant Isolation Bypass in FMCS Floater Modegrokability snipe-it CVE-2026-55542Snipe-IT's S3 signature image retrieval lacks authorization before temporary URLgrokability snipe-it CVE-2026-55519Snipe-IT: Improper Authorization in File Deletion (IDOR)grokability snipe-it CVE-2026-55516Snipe-IT: Cross-company asset maintenance re-parenting via API updategrokability snipe-it CVE-2026-55515Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpointgrokability snipe-it CVE-2026-55483Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creationgrokability snipe-it CVE-2026-55482Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Updategrokability snipe-it CVE-2026-55481Snipe-IT: CSS Injection via `header_color` Settinggrokability snipe-it CVE-2026-55479Snipe-IT: Incorrect permission for legacy license checkin APIgrokability snipe-it CVE-2026-55478Snipe-IT: Missing object-level authorization in Kits APIgrokability snipe-it CVE-2026-55476Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parametergrokability snipe-it CVE-2026-55475Snipe-IT: Import created_by can be overwrittengrokability snipe-it CVE-2026-55474Snipe-IT: Directory traversal in displaySiggrokability snipe-it CVE-2026-55472Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validationgrokability snipe-it CVE-2026-55469Snipe-IT: Path traversal vulnerability via CSV import `image` fieldgrokability snipe-it CVE-2026-55466Snipe-IT: Stored XSS via inline-served attachmentgrokability snipe-it CVE-2026-55464Snipe-IT: Stored XSS via Markdown custom fieldgrokability snipe-it CVE-2026-55462Snipe-IT: Authorization bypass on print inventory pagegrokability snipe-it CVE-2026-55461Snipe-IT: Open Redirect After User Editgrokability snipe-it CVE-2026-55460Snipe-IT: Authorization bypass on bulk editing usersgrokability snipe-it CVE-2026-55452Snipe-IT: CSV formula injection in Activity Report exportgrokability snipe-it CVE-2026-54329Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT APIgrokability snipe-it CVE-2026-50550Snipe-IT: 2FA reset privilege bypassgrokability snipe-it CVE-2026-49976Snipe-IT: User Account Escalation via CSV Importgrokability snipe-it CVE-2026-49870Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`grokability snipe-it CVE-2026-48507Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing usersgrokability snipe-it CVE-2026-48493Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignmentgrokability snipe-it CVE-2026-48492Snipe-IT's selectlist visibility is too permissivegrokability snipe-it CVE-2026-44833Snipe-IT: Open redirect vulnerabilitygrokability snipe-it CVE-2026-44832Snipe-IT: Privilege Escalation via API Permissions Assignmentgrokability snipe-it CVE-2026-44831Snipe-IT: XSS vulnerability in component notesgrokability snipe-it CVE-2026-19579Snipe-IT Checkout Request Cancellation IDORGrokability Snipe-IT CVE-2025-15602Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege EscalationGrokability, Inc. Snipe-IT 83 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.