[HIGH] Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

PKSA-yjnz-vzp8-t7f6 CVE-2026-63498 GHSA-396x-xmvh-p563

Affected version: <8.7.0

Reported by:
GitHub

[HIGH] Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

PKSA-t5db-tq3m-tn97 CVE-2026-62368 GHSA-p9h3-gvpq-5539

Affected version: <8.7.0

Reported by:
GitHub

[HIGH] Snipe-IT: 2FA bypass via the API token flow

PKSA-2634-9r51-kjsx CVE-2026-63493 GHSA-hxcx-9h4f-42xx

Affected version: <8.7.0

Reported by:
GitHub

[MEDIUM] Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

PKSA-2v9y-4jt3-bxpm CVE-2026-55703 GHSA-r9r3-g9fp-3q4q

Affected version: <8.6.3

Reported by:
GitHub

[HIGH] Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

PKSA-9n96-zyz7-nxh9 CVE-2026-55694 GHSA-3hgv-jr5j-cg9x

Affected version: <8.6.3

Reported by:
GitHub

[HIGH] Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

PKSA-g91f-rycz-yjcf CVE-2026-55643 GHSA-c6w2-j4wq-mvwg

Affected version: <8.6.3

Reported by:
GitHub