Grokability vulnerabilities
91 CVEs and advisories name Grokability as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-55483Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation
- CVE-2026-50550Snipe-IT: 2FA reset privilege bypass
- CVE-2026-49870Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
- CVE-2026-49976Snipe-IT: User Account Escalation via CSV Import
- CVE-2026-19579Snipe-IT Checkout Request Cancellation IDOR
- CVE-2026-55481Snipe-IT: CSS Injection via `header_color` Setting
- CVE-2026-55475Snipe-IT: Import created_by can be overwritten
- CVE-2026-55469Snipe-IT: Path traversal vulnerability via CSV import `image` field
- CVE-2026-55461Snipe-IT: Open Redirect After User Edit
- CVE-2026-55479Snipe-IT: Incorrect permission for legacy license checkin API
- CVE-2026-55452Snipe-IT: CSV formula injection in Activity Report export
- CVE-2026-55466Snipe-IT: Stored XSS via inline-served attachment
- CVE-2026-55515Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
- CVE-2026-55462Snipe-IT: Authorization bypass on print inventory page
- CVE-2026-55464Snipe-IT: Stored XSS via Markdown custom field
- CVE-2026-55460Snipe-IT: Authorization bypass on bulk editing users
- CVE-2026-55472Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
- CVE-2026-55476Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
- CVE-2026-55478Snipe-IT: Missing object-level authorization in Kits API
- CVE-2026-55843Snipe-IT: Improper Privilege Management
- CVE-2026-55516Snipe-IT: Cross-company asset maintenance re-parenting via API update
- CVE-2026-55474Snipe-IT: Directory traversal in displaySig
- CVE-2026-54329Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
- CVE-2026-48492Snipe-IT's selectlist visibility is too permissive
- CVE-2026-55542Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
- CVE-2026-48493Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
- CVE-2026-48507Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
- CVE-2026-44833Snipe-IT: Open redirect vulnerability
- CVE-2026-44832Snipe-IT: Privilege Escalation via API Permissions Assignment
- CVE-2026-44831Snipe-IT: XSS vulnerability in component notes