98,920 indexed
CVECVE vulnerabilities
98,920 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,751–7,800 of 98,920 · page 156 of 1979
| ID | Title | Summary |
|---|---|---|
| CVE-2026-86767 | CVE-2026-86767 CVSS 5.0snipeitapp | Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, all… |
| CVE-2026-86766 | CVE-2026-86766 CVSS 6.5snipeitapp | Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}… |
| CVE-2026-86765 | CVE-2026-86765 CVSS 6.5snipeitapp | Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users wi… |
| CVE-2026-86764 | CVE-2026-86764 CVSS 6.5snipeitapp | Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/… |
| CVE-2026-86763 | CVE-2026-86763 CVSS 3.5snipeitapp | Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.inde… |
| CVE-2026-86762 | CVE-2026-86762 CVSS 8.1snipeitapp | Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not… |
| CVE-2026-86761 | CVE-2026-86761 CVSS 4.3snipeitapp | snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. … |
| CVE-2026-86760 | CVE-2026-86760 CVSS 5.4snipeitapp | Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The sin… |
| CVE-2026-8676 | CVE-2026-8676 CVSS 8.8 | An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond. |
| CVE-2026-86759 | CVE-2026-86759 CVSS 7.1snipeitapp | Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify a… |
| CVE-2026-86758 | CVE-2026-86758 CVSS 6.5snipeitapp | Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only l… |
| CVE-2026-86757 | CVE-2026-86757 CVSS 6.5snipeitapp | Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date… |
| CVE-2026-86756 | CVE-2026-86756 CVSS 6.1snipeitapp | Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /saml/acs). The endpoin… |
| CVE-2026-86755 | CVE-2026-86755 CVSS 5.4snipeitapp | Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*)… |
| CVE-2026-86754 | CVE-2026-86754 CVSS 7.3snipeitapp | Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with … |
| CVE-2026-86753 | CVE-2026-86753 CVSS 4.3snipeitapp | snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticate… |
| CVE-2026-86752 | CVE-2026-86752 CVSS 5.4snipeitapp | snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-la… |
| CVE-2026-86751 | CVE-2026-86751 CVSS 8.5snipeitapp | Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue se… |
| CVE-2026-86750 | CVE-2026-86750 CVSS 7.7snipeitapp | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersContr… |
| CVE-2026-86749 | CVE-2026-86749 CVSS 6.3snipeitapp | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). Because Laravel's … |
| CVE-2026-86748 | CVE-2026-86748 CVSS 6.1snipeitapp | Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or inval… |
| CVE-2026-86747 | CVE-2026-86747 CVSS 5.4snipeitapp | Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unaccepted_assets/s… |
| CVE-2026-86746 | CVE-2026-86746 CVSS 6.4snipeitapp | Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within comp… |
| CVE-2026-86745 | CVE-2026-86745 CVSS 6.5snipeitapp | Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged release), SettingsControl… |
| CVE-2026-86744 | CVE-2026-86744 CVSS 2.2snipeitapp | Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::check… |
| CVE-2026-86743 | CVE-2026-86743 CVSS 5.0snipeitapp | Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acc… |
| CVE-2026-86742 | CVE-2026-86742 CVSS 6.5snipeitapp | Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceRepo… |
| CVE-2026-86741 | CVE-2026-86741 CVSS 8.5snipeitapp | Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege … |
| CVE-2026-86740 | CVE-2026-86740 CVSS 3.8snipeitapp | Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), a… |
| CVE-2026-8674 | CVE-2026-8674 CVSS 5.3 | Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 cha… |
| CVE-2026-86739 | CVE-2026-86739 CVSS 3.1snipeitapp | Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\Acceptanc… |
| CVE-2026-86738 | CVE-2026-86738 CVSS 8.7snipeitapp | Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on grea… |
| CVE-2026-86737 | CVE-2026-86737 CVSS 4.3snipeitapp | snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asse… |
| CVE-2026-86736 | CVE-2026-86736 CVSS 4.3snipeitapp | snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.reques… |
| CVE-2026-86735 | CVE-2026-86735 CVSS 5.0snipeitapp | snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addr… |
| CVE-2026-86734 | CVE-2026-86734 CVSS 6.5snipeitapp | Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit … |
| CVE-2026-86733 | CVE-2026-86733 CVSS 7.2snipeitapp | Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-… |
| CVE-2026-86732 | CVE-2026-86732 CVSS 8.8 | Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to inst… |
| CVE-2026-86731 | CVE-2026-86731 CVSS 6.5 | Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While t… |
| CVE-2026-86730 | CVE-2026-86730 CVSS 8.8 | Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavi… |
| CVE-2026-8673 | CVE-2026-8673 CVSS 5.9avantra | Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: befor… |
| CVE-2026-86729 | CVE-2026-86729 CVSS 7.4 | WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Un… |
| CVE-2026-86728 | CVE-2026-86728 CVSS 7.5 | AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to… |
| CVE-2026-86727 | CVE-2026-86727 CVSS 7.5 | AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream key… |
| CVE-2026-86726 | CVE-2026-86726 CVSS 6.5 | AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream… |
| CVE-2026-86725 | CVE-2026-86725 CVSS 7.1 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoi… |
| CVE-2026-86724 | CVE-2026-86724 CVSS 6.5 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php tha… |
| CVE-2026-86723 | CVE-2026-86723 CVSS 8.1 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comp… |
| CVE-2026-86722 | CVE-2026-86722 CVSS 8.1 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that write… |
| CVE-2026-86721 | CVE-2026-86721 CVSS 7.5 | AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['… |