PatchClock

PHP security digest · Packages

snipe/snipe-it security advisories

3 advisories we have followed since September 2026, 3 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. High 24 Sep 2026

    Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

    Fixed in 8.7.0 · CVE-2026-63498

  2. High 24 Sep 2026

    Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

    Fixed in 8.7.0 · CVE-2026-62368

  3. High 24 Sep 2026

    Snipe-IT: 2FA bypass via the API token flow

    Fixed in 8.7.0 · CVE-2026-63493

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including snipe/snipe-it, and the version that fixes it.