CVE-2026-114064

The record

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.

Affected packages

Related vulnerabilities

• CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a… CWE-203
• CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted… CWE-203
• CVE-2026-111933 Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before… CWE-203
• CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <=… CWE-203
• CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to… CWE-203
• CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
• CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap… CWE-203
• CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. CWE-203