{"vulnerability": "cve-2026-5547", "sightings": [{"uuid": "e4edd729-e9a2-4de0-b813-1c6cb8fecbee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5547", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miqds72wq624", "content": "", "creation_timestamp": "2026-04-05T08:35:56.917208Z"}, {"uuid": "bf9a1b23-5684-409e-8db8-fceeef201a80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55471", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf", "content": "", "creation_timestamp": "2026-06-17T13:06:00.000000Z"}, {"uuid": "4282095e-f0a3-4369-8118-9e0eff3b23bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55471", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq64rso5sc2z", "content": "CVE-2026-55471 - ca.uhn.hapi.fhir:org.hl7.fhir.utilities\nThe HAPI FHIR software has a security issue where an attacker can access and disclose local files or hijack the system by manipulating XML data. This is due\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#uhn #Java #CVE #infosec", "creation_timestamp": "2026-07-08T22:04:05.044226Z"}, {"uuid": "32ff96f5-7614-4699-b425-11de1613f51e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55472", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxdteayy2z", "content": "CVE-2026-55472 - Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation\nCVE ID : CVE-2026-55472\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Ful...", "creation_timestamp": "2026-07-10T20:10:06.600022Z"}, {"uuid": "fb181f22-288c-4bcb-b235-d4ccfdfe77e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55474", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxtv2z5a27", "content": "CVE-2026-55474 - Snipe-IT: Directory traversal in displaySig\nCVE ID : CVE-2026-55474\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the ro...", "creation_timestamp": "2026-07-10T20:19:06.102880Z"}, {"uuid": "aca4547f-df9f-41a9-a16a-717476a4fb33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55478", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcy666gy22k", "content": "CVE-2026-55478 - Snipe-IT: Missing object-level authorization in Kits API\nCVE ID : CVE-2026-55478\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses ch...", "creation_timestamp": "2026-07-10T20:24:53.335604Z"}, {"uuid": "cc3c0c85-1a77-45cf-9f9a-6c4fa1b1986f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55476", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcyku5uto2g", "content": "CVE-2026-55476 - Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter\nCVE ID : CVE-2026-55476\n \n Published : July 10, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST ...", "creation_timestamp": "2026-07-10T20:31:55.376526Z"}, {"uuid": "df08599c-431b-4f8e-8918-341a10e15ee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55472", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhp6pnjy2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55472 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f IT-\u0430\u043a\u0442\u0438\u0432\u0430\u043c\u0438\n\n\n\nhttps://kripta.biz/posts/85F8840B-6F66-4165-8D39-E782B0C13F8A", "creation_timestamp": "2026-07-11T01:02:46.948634Z"}, {"uuid": "19a492b9-ca42-4433-ad03-771dd8ff04e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55474", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhwmqcop2w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55474 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/445B9DE2-83AB-4566-9EB6-ED1E38E45C23", "creation_timestamp": "2026-07-11T01:06:56.595456Z"}, {"uuid": "7d7d1229-ff5d-43e5-b69e-4df9a96e34f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55476", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhxajxvf2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55476 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f IT-\u0430\u043a\u0442\u0438\u0432\u0430\u043c\u0438\n\n\n\nhttps://kripta.biz/posts/ACF4A8C0-7A5C-4859-A544-AEA1ACF0268E", "creation_timestamp": "2026-07-11T01:07:17.013159Z"}, {"uuid": "84b50bab-4643-4972-af5a-249e6efc02f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55478", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdi5jpwji2s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55478 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f IT-\u0430\u043a\u0442\u0438\u0432\u0430\u043c\u0438\n\n\n\nhttps://kripta.biz/posts/F838A32F-4FC5-408D-8921-6CCB52BDDEA3", "creation_timestamp": "2026-07-11T01:10:47.938716Z"}, {"uuid": "ec075c7f-8d9e-4587-b215-6692fb2b103a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55479", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdlaotrum2e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55479 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0418\u0422-\u0430\u043a\u0442\u0438\u0432\u0430\u043c\u0438\n\n\n\nhttps://kripta.biz/posts/14DCD976-53D5-40CD-978B-B45D3142BE33", "creation_timestamp": "2026-07-11T02:06:15.327024Z"}, {"uuid": "e3f3b249-a1c2-4f01-9cc5-2c6fe3461105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55475", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktlkikqr2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55475 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f IT-\u0430\u043a\u0442\u0438\u0432\u0430\u043c\u0438\n\n\n\nhttps://kripta.biz/posts/390AA24A-E63F-4938-B521-2D7FC5B97917", "creation_timestamp": "2026-07-13T23:24:09.242378Z"}, {"uuid": "00f20fa9-ac6f-4155-aaa9-0c7cbcf22f91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55472", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqldmljbyz2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55472 \u0432 Snipe-IT: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0418\u0422-\u0430\u043a\u0442\u0438\u0432\u0430\u043c\u0438\n\n\n\nhttps://kripta.biz/posts/288616FF-C024-4DBE-A822-C1A71508C48F", "creation_timestamp": "2026-07-14T04:11:02.655315Z"}, {"uuid": "2ff84037-4b37-4d9c-a74f-3505b55af30f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55472", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqslkqpza2g", "content": "\u05d7\u05e9\u05d9\u05e4\u05d4: \u05e4\u05d2\u05d9\u05e2\u05d4 \u05e7\u05e9\u05d4 \u05d1\u05de\u05e2\u05e8\u05db\u05ea \u05e0\u05d9\u05d4\u05d5\u05dc \u05e0\u05db\u05e1\u05d9 IT - Snipe-IT - CVE-2026-55472\n\n\n\nhttps://khesef.xyz/posts/A6B6468B-0D56-4B42-8F4E-556C64CD3EB2", "creation_timestamp": "2026-07-16T08:22:13.052434Z"}, {"uuid": "9e7e4120-3832-4d13-a6af-0556c18a13b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55477", "type": "published-proof-of-concept", "source": "https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg", "content": "", "creation_timestamp": "2026-08-24T22:35:03.708003Z"}, {"uuid": "7d47eb82-7261-4e75-8346-e4812b14dfe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55479", "type": "seen", "source": "https://gist.github.com/alon710/cba9cd0b7b8bf1e82dc1ef5c661263b6", "content": "# CVE-2026-55479: CVE-2026-55479: Incorrect Authorization Check in Snipe-IT Legacy License Check-in Flow\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55479\n\n## Summary\nSnipe-IT prior to version 8.6.2 is vulnerable to an incorrect authorization flaw (CWE-863) within its legacy single-seat license check-in workflow. The application incorrectly validates authorization using the 'checkout' permission instead of the 'checkin' permission. This allows authenticated users who are authorized only to assign licenses, but explicitly restricted from unassigning them, to directly access and execute license seat check-ins, bypassing intended role-based access controls.\n\n## TL;DR\nAn authorization logic error in Snipe-IT allows low-privilege users who only possess license checkout (assignment) permissions to bypass restrictions and execute license check-ins (reclamations), potentially disrupting asset tracking states.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.3 (Medium)\n- **CVSS v4.0 Score**: 5.3 (Medium)\n- **Exploit Status**: none\n- **CISA KEV Status**: False\n\n## Affected Systems\n\n- Snipe-IT installations prior to version 8.6.2\n- **snipe-it**: < 8.6.2 (Fixed in: `8.6.2`)\n\n## Mitigation\n\n- Upgrade the Snipe-IT instance to version 8.6.2 or later immediately.\n- If immediate upgrade is not possible, apply the manual PHP patch to LicenseCheckinController.php.\n- Audit active user roles to ensure that 'checkout' and 'checkin' permissions are correctly delineated.\n\n**Remediation Steps:**\n1. Navigate to the Snipe-IT root directory on the hosting server.\n2. Run the standard update scripts or pull the latest stable release (v8.6.2) from the official repository.\n3. If manually patching, locate the file 'app/Http/Controllers/Licenses/LicenseCheckinController.php'.\n4. Replace instances of '$this->authorize(\"checkout\", $license)' with '$this->authorize(\"checkin\", $license)' within both the create and store methods.\n5. Save the file and clear the application cache using the command 'php artisan cache:clear'.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/grokability/snipe-it/security/advisories/GHSA-8frh-vhgh-64cf)\n- [NVD Vulnerability Detail Page](https://nvd.nist.gov/vuln/detail/CVE-2026-55479)\n- [CVE.org Authoritative Vulnerability Record](https://www.cve.org/CVERecord?id=CVE-2026-55479)\n- [Wiz Vulnerability Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-55479)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55479) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T18:32:25.134945Z"}, {"uuid": "de131661-69d7-4980-a234-5154f6313008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55477", "type": "seen", "source": "https://gist.github.com/alon710/782a9d0e0a33092c615e2219299ab6e3", "content": "# CVE-2026-55477: CVE-2026-55477: Authenticated Arbitrary File Write in MHSanaei 3X-UI via Database Import\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55477\n\n## Summary\nMHSanaei 3X-UI is a web control panel for managing Xray-core servers. In versions prior to 3.3.1, an authenticated administrator can abuse database import functions or raw template config fields to overwrite or append to arbitrary files on the host filesystem. This is achieved by altering the Xray log configuration variables to target system files, leveraging logging components to inject payloads.\n\n## TL;DR\nAn authenticated administrator in 3X-UI versions prior to 3.3.1 can perform remote code execution with root privileges by manipulating Xray log file paths to target host files like authorized_keys.\n\n## Technical Details\n\n- **CWE ID**: CWE-73 (External Control of File Name or Path)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.2\n- **EPSS Score**: 0.00615 (Percentile: 46.77%)\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- 3X-UI Control Panel\n\n## Mitigation\n\n- Upgrade 3X-UI to version 3.3.1 or newer to enforce strict folder confinement of log files.\n- Restrict administration port access to trusted source IP addresses via firewall filters.\n- Execute the Xray daemon process under a restricted, non-root system account.\n\n**Remediation Steps:**\n1. Download the v3.3.1 patch from the repository releases.\n2. Review the DB settings table to ensure log parameters do not point to absolute target paths.\n3. Deploy the updated application container or execution scripts.\n\n## References\n\n- [GitHub Security Advisory (GHSA-jm48-m3rr-9hgg)](https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-55477)\n- [Official Fix Commit](https://github.com/MHSanaei/3x-ui/commit/80e168787ed608e83a065033ee94c8bfc3025ce7)\n- [Secure Release (v3.3.1)](https://github.com/MHSanaei/3x-ui/releases/tag/v3.3.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55477) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T12:31:18.455201Z"}]}