How many CVEs have patched checkout?

6 published CVEs changed checkout in grokability/snipe-it, in 4 distinct patches totalling 720 changed lines, between 2026 and 2026.

What is the latest CVE that changed checkout?

CVE-2026-86766 (Snipe-IT 8.6.3 Race Condition via Consumable Checkout), published 2026-09-09, changed lines 329 to 385 of app/Http/Controllers/Api/AccessoriesController.php.

How does checkout compare to the rest of grokability/snipe-it?

grokability/snipe-it has 53 CVEs with a located fix in total; 6 of them changed checkout.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

checkout in grokability/snipe-it: Patched by 6 CVEs

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

CVE-2026-86766 · app/Http/Controllers/Api/AccessoriesController.php · lines 329–385 · +22 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.3%2026-09-09

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

CVE-2026-86766 · app/Http/Controllers/Api/ComponentsController.php · lines 344–397 · +24 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.3%2026-09-09

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

CVE-2026-86766 · app/Http/Controllers/Api/ConsumablesController.php · lines 339–390 · +27 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.3%2026-09-09

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

CVE-2026-86765 · app/Http/Controllers/Api/AccessoriesController.php · lines 329–385 · +22 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.4%2026-09-09

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

CVE-2026-86765 · app/Http/Controllers/Api/ComponentsController.php · lines 344–397 · +24 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.4%2026-09-09

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

CVE-2026-86765 · app/Http/Controllers/Api/ConsumablesController.php · lines 339–390 · +27 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.4%2026-09-09

snipe-it before 8.7.0 Race Condition in Asset Checkout

CVE-2026-86744 · app/Http/Controllers/Api/AccessoriesController.php · lines 329–385 · +22 −2 in 2 hunks

Low · CVSS 2.1

EPSS 0.3%2026-09-09

snipe-it before 8.7.0 Race Condition in Asset Checkout

CVE-2026-86744 · app/Http/Controllers/Api/ComponentsController.php · lines 344–397 · +24 −2 in 2 hunks

Low · CVSS 2.1

EPSS 0.3%2026-09-09

snipe-it before 8.7.0 Race Condition in Asset Checkout

CVE-2026-86744 · app/Http/Controllers/Api/ConsumablesController.php · lines 339–390 · +27 −2 in 2 hunks

Low · CVSS 2.1

EPSS 0.3%2026-09-09

Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

CVE-2026-49870 · app/Http/Controllers/Api/LicensesController.php · lines 270–430 · +161 −0

Medium · CVSS 5.9

EPSS 0.4%2026-08-19

Snipe-IT: User Account Escalation via CSV Import

CVE-2026-49976 · app/Http/Controllers/Api/LicensesController.php · lines 270–430 · +161 −0

Medium · CVSS 6.5

EPSS 0.5%2026-08-19

Snipe-IT: Import created_by can be overwritten

CVE-2026-55475 · app/Http/Controllers/Api/LicensesController.php · lines 270–430 · +161 −0

Medium · CVSS 5.7

EPSS 0.3%2026-07-10

checkout

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track grokability/snipe-it CVEs