Grokability vulnerabilities
91 CVEs and advisories name Grokability as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116201Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
- CVE-2026-116200Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
- CVE-2026-116199Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2026-116198Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
- CVE-2026-114064Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint
- CVE-2026-62368Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
- CVE-2026-63493Snipe-IT: 2FA bypass via the API token flow
- CVE-2026-63498Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
- CVE-2026-88894Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
- CVE-2026-86774Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
- CVE-2026-86773Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
- CVE-2026-86772Snipe-IT 8.6.3 Stored XSS via Department Names
- CVE-2026-86771Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
- CVE-2026-86770Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- CVE-2026-86769Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
- CVE-2026-86768Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
- CVE-2026-86767Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
- CVE-2026-86766Snipe-IT 8.6.3 Race Condition via Consumable Checkout
- CVE-2026-86765Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
- CVE-2026-86764Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
- CVE-2026-86763snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
- CVE-2026-86762Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
- CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
- CVE-2026-86760snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag
- CVE-2026-86759Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
- CVE-2026-86758Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- CVE-2026-86757Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
- CVE-2026-86756Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
- CVE-2026-86755Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth
- CVE-2026-86754Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients