Security: grokability/snipe-it
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
CSV Formula Injection in Asset Acceptance Report ExportGHSA-w4xq-9p85-4qmv published
Aug 24, 2026 by snipeModerate -
FMCS Scope Gap: Asset Acceptance Report Discloses Cross-Company Pending AcceptancesGHSA-7xrr-xm47-rc6w published
Aug 24, 2026 by snipeHigh -
Race Condition in Asset Checkout Allows Duplicate Checkout History and Counter UpdatesGHSA-h992-9438-26v8 published
Aug 24, 2026 by snipeLow -
CSV Formula Injection in FMCS Location-Scoping ExportGHSA-79jf-ppgj-5cc3 published
Aug 24, 2026 by snipeModerate -
Livewire Component Authorization Bypass via `POST /livewire/update` Snapshot ReplayGHSA-jchx-hfqg-rm2m published
Aug 24, 2026 by snipeModerate -
Reports: Pivot-Only User Bypasses FMCS Scope on Acceptance Reminder and Delete EndpointsGHSA-p5wx-p3vv-g6p2 published
Aug 24, 2026 by snipeModerate -
Restore Wipes Database Before Validating the Backup ArchiveGHSA-4cr5-3hw8-8w5f published
Aug 24, 2026 by snipeModerate -
Failed Image Write Destroys Existing Image and Leaves Model Pointing at Phantom FileGHSA-v37p-hr9x-5w85 published
Aug 24, 2026 by snipeModerate -
API User Create/Update Persists Cross-Tenant Company Assignment Before AuthorizationGHSA-c929-qxg6-r3mc published
Aug 24, 2026 by snipeHigh -
Arbitrary File Read and SSRF via Markdown Image Injection in Outbound MailGHSA-f3vq-g24v-xc2g published
Aug 24, 2026 by snipeCritical