https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:10:59.653782+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-365651 EUVD-2026-365651 2026-10-03T20:10:59.700076+00:00 EUVD-2026-365651 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86768 fkie_cve-2026-86768 2026-10-03T20:10:59.700130+00:00

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

 https://cve.radiocsirt.org/vuln/ghsa-j6fh-grf4-39xr GHSA-j6fh-grf4-39xr 2026-10-03T20:10:59.700165+00:00

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2981 WID-SEC-W-2026-2981 — Snipe-IT: Mehrere Schwachstellen 2026-10-03T20:10:59.700183+00:00

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren, Konten zu übernehmen oder Denial-of-Service-Zustände herbeizuführen.