HIGH7.8CVE-2026-27806Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit in github.com/fleetdm/fleet from 0, < 4.81.1
HIGH7.8CVE-2026-27806Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit in github.com/fleetdm/fleet from 0, < 4.81.1
HIGH7.5CVE-2026-24899Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet from 0, < 4.82.0
HIGH7.5Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet
from 0, < 4.82.0
HIGH7.5Windows MDM management endpoint authentication bypass in github.com/fleetdm/fleet/v4
from 0, < 4.81.0
HIGH7.5Windows MDM management endpoint authentication bypass in github.com/fleetdm/fleet/v4
from 0, < 4.81.0
MEDIUM6.5Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet
from 0, < 4.84.2
MEDIUM6.5Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet
from 0, < 4.84.2
MEDIUM6.5Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet
from 0, < 4.84.2
MEDIUM6.5Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet
from 0, < 4.84.2
MEDIUM5.3Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet
from 0, < 4.80.1
MEDIUM5.3Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet
from 0, < 4.80.1
MEDIUM5.3Limited ability to spoof SAML authentication with missing audience verification in Fleet
from 0, < 4.9.1
MEDIUM4.3Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet
from 0, < 4.85.0
MEDIUM4.3Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet
from 0, < 4.85.0
—Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet
from 0, < 4.81.1
—Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet
from 0, < 4.81.1
—Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet
from 0, < 4.81.0
—Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet
from 0, < 4.81.0
—A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet
from 0, < 4.81.1
—A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet
from 0, < 4.81.1
—Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet
from 0, < 4.43.5-0.20260113202849-bbc1aef2987d
—Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet
from 0
—Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet
from 0, < 4.43.5-0.20260113202849-bbc1aef2987d
—Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet
from 0
—Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Device lock PIN can be predicted if lock time is known in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet: Device lock PIN can be predicted if lock time is known in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter in github.com/fleetdm/fleet
from 0, < 4.80.1
—Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet
>= 4.75.0, < 4.75.2, >= 4.76.0, < 4.76.2, >= 4.77.0, < 4.77.1, >= 4.78.0, < 4.78.3
—Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet
from 0, < 4.78.3-0.20260112221730-5c030e32a3a9
—Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet
>= 4.75.0, < 4.75.2, >= 4.76.0, < 4.76.2, >= 4.77.0, < 4.77.1, >= 4.78.0, < 4.78.3
—Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability in github.com/fleetdm/fleet
from 0, < 4.43.5-0.20260111020427-0e6c790803d1
—Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability in github.com/fleetdm/fleet
>= 4.75.0, < 4.75.2, >= 4.76.0, < 4.76.2, >= 4.77.0, < 4.77.1, >= 4.78.0, < 4.78.2
—Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet
>= 4.64.0, < 4.64.2
—Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet
from 0
—SAML authentication vulnerability due to stdlib XML parsing
from 0, < 3.5.1