Security Advisories | GitStock

high2026-08-28

CVE-2026-55245-Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL

maximhq/bifrost · GHSA-w98g-5w9p-p3rc

low2026-08-28

CVE-2026-55588-ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption

oras-project/oras · GHSA-298f-872v-2rcx

high2026-08-28

CVE-2026-55485-piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

piccolo-orm/piccolo_admin · GHSA-2gh4-jmwq-rr8w

high2026-08-28

CVE-2026-55509-WsgiDAV MySQL provider has a blind SQL injection

mar10/wsgidav · GHSA-p6gw-4frg-j7jw

medium2026-08-28

CVE-2026-55425-Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields

graylog2/graylog2-server · GHSA-q79r-r9xg-r863

high2026-08-28

CVE-2026-55516-Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update

grokability/snipe-it · GHSA-575r-357h-fhch

medium2026-08-28

CVE-2026-55515-Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

grokability/snipe-it · GHSA-35cr-9hqq-p2mg

medium2026-08-28

CVE-2026-55481-Snipe-IT has CSS Injection via `header_color` Setting

grokability/snipe-it · GHSA-w7qw-5wfv-gwx9

medium2026-08-28

CVE-2026-55479-Snipe-IT has incorrect permission for legacy license checkin API

grokability/snipe-it · GHSA-8frh-vhgh-64cf

medium2026-08-28

CVE-2026-55478-Snipe-IT has missing object-level authorization in Kits API

grokability/snipe-it · GHSA-crv3-j83j-f3r6

medium2026-08-28

CVE-2026-55476-Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

grokability/snipe-it · GHSA-53jc-27pc-x8r8

medium2026-08-28

CVE-2026-55475-Snipe-IT's import created_by can be overwritten

grokability/snipe-it · GHSA-5wx7-xq8j-v4qm

high2026-08-28

CVE-2026-55474-Snipe-IT vulnerable to directory traversal in displaySig

grokability/snipe-it · GHSA-c6f4-wj38-m3g3

medium2026-08-28

CVE-2026-55472-Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

grokability/snipe-it · GHSA-8w8c-8mx9-52cw

low2026-08-28

CVE-2026-55469-Snipe-IT has a path traversal vulnerability via CSV import `image` field

grokability/snipe-it · GHSA-xr9m-gphc-9p63

medium2026-08-28

CVE-2026-55466-Snipe-IT vulnerable to stored XSS via inline-served attachment

grokability/snipe-it · GHSA-jhph-5q74-pmfx

medium2026-08-28

CVE-2026-55464-Snipe-IT vulnerable to stored XSS via Markdown custom field

grokability/snipe-it · GHSA-r52f-r9v5-66xr

medium2026-08-28

CVE-2026-55462-Snipe-IT has an authorization bypass on print inventory page

grokability/snipe-it · GHSA-fc33-6w3q-538h

medium2026-08-28

CVE-2026-55461-Snipe-IT has an Open Redirect After User Edit

grokability/snipe-it · GHSA-wg2f-x2c2-c4rp

high2026-08-28

CVE-2026-55460-Snipe-IT has an authorization bypass on bulk editing users

grokability/snipe-it · GHSA-vgx7-c78r-69w9