https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:31:55.334338+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-367841 EUVD-2026-367841 2026-10-02T15:31:55.550055+00:00 EUVD-2026-367841 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86770 fkie_cve-2026-86770 2026-10-02T15:31:55.550093+00:00

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

 https://cve.radiocsirt.org/vuln/ghsa-vp3x-c2h8-v6w8 GHSA-vp3x-c2h8-v6w8 2026-10-02T15:31:55.550129+00:00

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2981 WID-SEC-W-2026-2981 — Snipe-IT: Mehrere Schwachstellen 2026-10-02T15:31:55.550148+00:00

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren, Konten zu übernehmen oder Denial-of-Service-Zustände herbeizuführen.