# cve.now: Grokability

The newest entries naming Grokability as an affected vendor (up to 200), of 91 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116201](https://cve.now/CVE-2026-116201.md): Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition (CVSS 8.7)
- [CVE-2026-116200](https://cve.now/CVE-2026-116200.md): Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() (CVSS 8.2)
- [CVE-2026-116199](https://cve.now/CVE-2026-116199.md): Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback (CVSS 9.2)
- [CVE-2026-116198](https://cve.now/CVE-2026-116198.md): Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store (CVSS 5.3)
- [CVE-2026-114064](https://cve.now/CVE-2026-114064.md): Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint (CVSS 5.1)
- [CVE-2026-62368](https://cve.now/CVE-2026-62368.md): Snipe-IT: Stored XSS via Custom Field name in asset-list column headers (CVSS 8.1)
- [CVE-2026-63493](https://cve.now/CVE-2026-63493.md): Snipe-IT: 2FA bypass via the API token flow (CVSS 8.6)
- [CVE-2026-63498](https://cve.now/CVE-2026-63498.md): Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API (CVSS 8.7)
- [CVE-2026-88894](https://cve.now/CVE-2026-88894.md): Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout (CVSS 5.3)
- [CVE-2026-86774](https://cve.now/CVE-2026-86774.md): Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy (CVSS 5.3)
- [CVE-2026-86773](https://cve.now/CVE-2026-86773.md): Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints (CVSS 5.3)
- [CVE-2026-86772](https://cve.now/CVE-2026-86772.md): Snipe-IT 8.6.3 Stored XSS via Department Names (CVSS 5.1)
- [CVE-2026-86771](https://cve.now/CVE-2026-86771.md): Snipe-IT before 8.7.0 Server-Side Request Forgery via employee\_num (CVSS 8.3)
- [CVE-2026-86770](https://cve.now/CVE-2026-86770.md): Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation (CVSS 8.6)
- [CVE-2026-86769](https://cve.now/CVE-2026-86769.md): Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout (CVSS 5.3)
- [CVE-2026-86768](https://cve.now/CVE-2026-86768.md): Snipe-IT before 8.7.0 Improper Input Validation via API Checkout (CVSS 5.3)
- [CVE-2026-86767](https://cve.now/CVE-2026-86767.md): Snipe-IT before 8.7.0 Cross-Company Read via requested-assets (CVSS 5.3)
- [CVE-2026-86766](https://cve.now/CVE-2026-86766.md): Snipe-IT 8.6.3 Race Condition via Consumable Checkout (CVSS 7.1)
- [CVE-2026-86765](https://cve.now/CVE-2026-86765.md): Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint (CVSS 7.1)
- [CVE-2026-86764](https://cve.now/CVE-2026-86764.md): Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components (CVSS 7.1)
- [CVE-2026-86763](https://cve.now/CVE-2026-86763.md): snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer (CVSS 5.1)
- [CVE-2026-86762](https://cve.now/CVE-2026-86762.md): Snipe-IT before 8.7.0 Authentication Bypass via API Middleware (CVSS 8.6)
- [CVE-2026-86761](https://cve.now/CVE-2026-86761.md): snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints (CVSS 5.3)
- [CVE-2026-86760](https://cve.now/CVE-2026-86760.md): snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag (CVSS 5.3)
- [CVE-2026-86759](https://cve.now/CVE-2026-86759.md): Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer (CVSS 7.1)
- [CVE-2026-86758](https://cve.now/CVE-2026-86758.md): Snipe-IT before 8.7.0 License Key Exposure via CSV Export (CVSS 7.1)
- [CVE-2026-86757](https://cve.now/CVE-2026-86757.md): Snipe-IT before 8.7.0 Information Disclosure via Custom Fields (CVSS 7.1)
- [CVE-2026-86756](https://cve.now/CVE-2026-86756.md): Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState (CVSS 5.3)
- [CVE-2026-86755](https://cve.now/CVE-2026-86755.md): Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth (CVSS 5.3)
- [CVE-2026-86754](https://cve.now/CVE-2026-86754.md): Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients (CVSS 8.5)
- [CVE-2026-86753](https://cve.now/CVE-2026-86753.md): snipe-it before 8.7.0 Business Logic Bypass via asset\_model endpoint (CVSS 5.3)
- [CVE-2026-86752](https://cve.now/CVE-2026-86752.md): snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints (CVSS 5.3)
- [CVE-2026-86751](https://cve.now/CVE-2026-86751.md): Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown (CVSS 8.4)
- [CVE-2026-86750](https://cve.now/CVE-2026-86750.md): snipe-it before 8.7.0 Authorization Bypass via API User Create/Update (CVSS 8.3)
- [CVE-2026-86749](https://cve.now/CVE-2026-86749.md): snipe-it before 8.7.0 Data Loss via Failed Image Write (CVSS 7.0)
- [CVE-2026-86748](https://cve.now/CVE-2026-86748.md): Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive (CVSS 6.9)
- [CVE-2026-86747](https://cve.now/CVE-2026-86747.md): snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User (CVSS 5.3)
- [CVE-2026-86746](https://cve.now/CVE-2026-86746.md): Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay (CVSS 7.4)
- [CVE-2026-86745](https://cve.now/CVE-2026-86745.md): Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export (CVSS 5.1)
- [CVE-2026-86744](https://cve.now/CVE-2026-86744.md): snipe-it before 8.7.0 Race Condition in Asset Checkout (CVSS 2.1)
- [CVE-2026-86743](https://cve.now/CVE-2026-86743.md): Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report (CVSS 5.3)
- [CVE-2026-86742](https://cve.now/CVE-2026-86742.md): Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report (CVSS 5.1)
- [CVE-2026-86741](https://cve.now/CVE-2026-86741.md): Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA (CVSS 8.4)
- [CVE-2026-86740](https://cve.now/CVE-2026-86740.md): Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains (CVSS 5.1)
- [CVE-2026-86739](https://cve.now/CVE-2026-86739.md): Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence (CVSS 2.3)
- [CVE-2026-86738](https://cve.now/CVE-2026-86738.md): Snipe-IT before 8.7.0 CSS Injection via Custom CSS (CVSS 9.3)
- [CVE-2026-86737](https://cve.now/CVE-2026-86737.md): snipe-it before 8.7.0 Missing Authorization via barcode endpoint (CVSS 5.3)
- [CVE-2026-86736](https://cve.now/CVE-2026-86736.md): snipe-it before 8.7.0 Checkout Request Counter Integrity Failure (CVSS 5.3)
- [CVE-2026-86735](https://cve.now/CVE-2026-86735.md): snipe-it before 8.7.0 SSRF via IPv6 transition address bypass (CVSS 5.9)
- [CVE-2026-86734](https://cve.now/CVE-2026-86734.md): Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field (CVSS 7.1)
- [CVE-2026-86733](https://cve.now/CVE-2026-86733.md): Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore (CVSS 8.6)
- [CVE-2026-85617](https://cve.now/CVE-2026-85617.md): snipe-it before 8.6.3 Authorization Bypass via Bulk Delete (CVSS 8.7)
- [CVE-2026-85616](https://cve.now/CVE-2026-85616.md): Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance (CVSS 8.4)
- [CVE-2026-84206](https://cve.now/CVE-2026-84206.md): Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore (CVSS 5.3)
- [CVE-2026-55694](https://cve.now/CVE-2026-55694.md): Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover (CVSS 7.1)
- [CVE-2026-55643](https://cve.now/CVE-2026-55643.md): Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode (CVSS 7.6)
- [CVE-2026-55703](https://cve.now/CVE-2026-55703.md): Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET (CVSS 4.3)
- [CVE-2026-61807](https://cve.now/CVE-2026-61807.md): Snipe-IT: Stored DOM XSS via table selected-count IDs (CVSS 6.3)
- [CVE-2026-55519](https://cve.now/CVE-2026-55519.md): Snipe-IT: Improper Authorization in File Deletion (IDOR) (CVSS 5.4)
- [CVE-2026-55482](https://cve.now/CVE-2026-55482.md): Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update (CVSS 6.3)
- [CVE-2026-55483](https://cve.now/CVE-2026-55483.md): Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation (CVSS 4.9)
- [CVE-2026-50550](https://cve.now/CVE-2026-50550.md): Snipe-IT: 2FA reset privilege bypass (CVSS 5.8)
- [CVE-2026-49870](https://cve.now/CVE-2026-49870.md): Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on \`POST /two-factor\` (CVSS 5.9)
- [CVE-2026-49976](https://cve.now/CVE-2026-49976.md): Snipe-IT: User Account Escalation via CSV Import (CVSS 6.5)
- [CVE-2026-19579](https://cve.now/CVE-2026-19579.md): Snipe-IT Checkout Request Cancellation IDOR (CVSS 5.3)
- [CVE-2026-55481](https://cve.now/CVE-2026-55481.md): Snipe-IT: CSS Injection via \`header\_color\` Setting (CVSS 6.2)
- [CVE-2026-55475](https://cve.now/CVE-2026-55475.md): Snipe-IT: Import created\_by can be overwritten (CVSS 5.7)
- [CVE-2026-55469](https://cve.now/CVE-2026-55469.md): Snipe-IT: Path traversal vulnerability via CSV import \`image\` field (CVSS 6.5)
- [CVE-2026-55461](https://cve.now/CVE-2026-55461.md): Snipe-IT: Open Redirect After User Edit (CVSS 6.1)
- [CVE-2026-55479](https://cve.now/CVE-2026-55479.md): Snipe-IT: Incorrect permission for legacy license checkin API (CVSS 5.3)
- [CVE-2026-55452](https://cve.now/CVE-2026-55452.md): Snipe-IT: CSV formula injection in Activity Report export (CVSS 4.8)
- [CVE-2026-55466](https://cve.now/CVE-2026-55466.md): Snipe-IT: Stored XSS via inline-served attachment (CVSS 6.2)
- [CVE-2026-55515](https://cve.now/CVE-2026-55515.md): Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint (CVSS 5.0)
- [CVE-2026-55462](https://cve.now/CVE-2026-55462.md): Snipe-IT: Authorization bypass on print inventory page (CVSS 4.3)
- [CVE-2026-55464](https://cve.now/CVE-2026-55464.md): Snipe-IT: Stored XSS via Markdown custom field (CVSS 4.8)
- [CVE-2026-55460](https://cve.now/CVE-2026-55460.md): Snipe-IT: Authorization bypass on bulk editing users (CVSS 7.1)
- [CVE-2026-55472](https://cve.now/CVE-2026-55472.md): Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation (CVSS 4.3)
- [CVE-2026-55476](https://cve.now/CVE-2026-55476.md): Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel\_by\_admin Parameter (CVSS 5.3)
- [CVE-2026-55478](https://cve.now/CVE-2026-55478.md): Snipe-IT: Missing object-level authorization in Kits API (CVSS 5.3)
- [CVE-2026-55843](https://cve.now/CVE-2026-55843.md): Snipe-IT: Improper Privilege Management (CVSS 7.0)
- [CVE-2026-55516](https://cve.now/CVE-2026-55516.md): Snipe-IT: Cross-company asset maintenance re-parenting via API update (CVSS 7.7)
- [CVE-2026-55474](https://cve.now/CVE-2026-55474.md): Snipe-IT: Directory traversal in displaySig (CVSS 7.1)
- [CVE-2026-54329](https://cve.now/CVE-2026-54329.md): Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API (CVSS 8.5)
- [CVE-2026-48492](https://cve.now/CVE-2026-48492.md): Snipe-IT's selectlist visibility is too permissive (CVSS 4.9)
- [CVE-2026-55542](https://cve.now/CVE-2026-55542.md): Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL (CVSS 1.3)
- [CVE-2026-48493](https://cve.now/CVE-2026-48493.md): Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment (CVSS 5.5)
- [CVE-2026-48507](https://cve.now/CVE-2026-48507.md): Snipe-IT: Bulk editing users allowed \`ldap\_import\` and \`activated\_in\` bulk editing users (CVSS 7.1)
- [CVE-2026-44833](https://cve.now/CVE-2026-44833.md): Snipe-IT: Open redirect vulnerability (CVSS 5.9)
- [CVE-2026-44832](https://cve.now/CVE-2026-44832.md): Snipe-IT: Privilege Escalation via API Permissions Assignment (CVSS 8.7)
- [CVE-2026-44831](https://cve.now/CVE-2026-44831.md): Snipe-IT: XSS vulnerability in component notes (CVSS 4.8)
- [CVE-2025-15602](https://cve.now/CVE-2025-15602.md): Snipe-IT \< 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation (CVSS 8.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/grokability
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.