Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.7	CVE-2026-116201	Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116201Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... Executive summary Snipe-IT versions before 8.5.0 contain a flaw that lets an attacker reuse a captured SAML login assertion to obtain multiple valid sessions for the same user. The advisory rates the severity as Moderate and says the fix is in version 8.5.0. Technical summary This is a race condition (TOCTOU, CWE-367) in the SAML assertion nonce check, enabling capture-replay (CWE-294). The nonce check and insert were not atomic and the saml_nonces.nonce column had a non-unique index, so two concurrent POST /saml/acs requests with the same captured assertion could both log in. Affected versions are stated as <= 8.4.1 and the patched version is 8.5.0, with fixes in commit 5b0a779c07 and a unique index migration that runs saml:clear_expired_nonces first. Preconditions are SAML SSO enabled with valid IdP metadata, an attacker holding one valid assertion, and the ability to submit it twice within a sub-second race window. No workaround is stated. Exploitation in the wild is not stated, and no CVE ID is listed (the advisory says No known CVE). Specific detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-w49g-f2jc-qxhg Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.2	CVE-2026-116200	Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116200Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds Executive summary Snipe-IT versions up to and including 8.6.2 can send LDAP login credentials, including the service account password and end-user passwords, in cleartext when an attacker on the network path interferes with the encrypted connection setup. The advisory rates the issue Moderate and recommends upgrading to version 8.6.3 or later, which fixes the flaw. Technical summary The flaw is a cleartext transmission of sensitive information issue (CWE-319) caused by an algorithm downgrade during negotiation (CWE-757). In Ldap::connectToLdap(), the return value of ldap_start_tls() was ignored, so when StartTLS failed, the code still performed an ldap_bind() in cleartext. Exploitation requires LDAP authentication enabled with ldap_tls = 1, and an attacker on the network path between Snipe-IT and the LDAP server, who answers the StartTLS request with a Protocol error or the server does not offer StartTLS. Affected versions are stated as <= 8.6.2 and the patched version is 8.6.3, fixed in commit 91ea06904f. The advisory does not state any workaround. It does not state whether exploitation has occurred in the wild, and no CVSS score is given. No detection guidance is provided beyond the stated exploitability conditions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-wx48-r3qh-jvh5 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Critical	9.2	CVE-2026-116199	Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116199Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... Executive summary A flaw in Snipe-IT, an IT asset management application, lets users who have been deactivated sign in through Google single sign-on if their Google account is still active. The advisory rates it Moderate and says it affects versions 8.6.2 and earlier. The vendor recommends upgrading to version 8.6.3 or later. Technical summary The Google SSO callback in GoogleAuthController::handleGoogleCallback looks up the local user by username matching the Google account email and logs them in without checking the activated flag, which is a missing authorization check (CWE-285) and an improper authentication weakness (CWE-287). The advisory says exploitation requires Google SSO to be enabled, a deployment that uses email-as-username or an email-shaped username on the account, a deactivated account, and a still-live Google identity. Affected versions are stated as 8.6.2 and earlier, and the fix is in 8.6.3 (commit 5fea2fadc0), which checks the activated flag after lookup. The advisory does not state a CVE ID, a CVSS score, or any workaround other than upgrading. It does not state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqp Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116198	Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116198Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... Executive summary Snipe-IT versions 8.6.3 and earlier have a flaw in the API asset-creation path that can store sensitive custom field values as plaintext when the caller lacks the permission needed to write encrypted fields. The advisory rates the issue Low and says it is fixed in version 8.7.0, which the vendor recommends installing. Technical summary The flaw is classified as missing encryption of sensitive data (CWE-311) and an always-incorrect control flow implementation (CWE-670) in Api\AssetsController::store. When the caller lacks assets.view.encrypted_custom_fields, the encryption call is skipped and the unencrypted value is written to the database column because the block lacks a continue statement, unlike the update path. The advisory states the affected versions are 8.6.3 and earlier and the fixed version is 8.7.0, with the fix in commit 34dafe9eed. The advisory does not state a CVE ID, a CVSS score, or any workaround. It also does not state whether exploitation has been observed or provide specific detection guidance beyond the description of the impact. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-jh4g-98fm-jcqc Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer