FL
Product
fleet
41
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 6High 18Medium 16Low 1
Watch
Add fleet to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34386 | 8.8 | Mar 27 | Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin Affected: < 4.81.0 |
| CVE-2026-29180 | 8.8 | Mar 27 | Fleet's team maintainer can transfer hosts from any team via missing source team authorization Affected: < 4.81.1 |
| CVE-2026-26060 | 8.8 | Mar 27 | Fleet: Password reset tokens remain valid after password change for 24 hours Affected: < 4.81.0 |
| CVE-2026-26186 | 8.8 | Feb 26 | Fleet has a SQL injection via backtick escape in ORDER BY parameter Affected: < 4.80.1 |
| CVE-2026-34385 | 8.1 | Mar 27 | Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database Affected: < 4.81.0 |
| CVE-2026-23517 | 8.1 | Jan 21 | Fleet has an Access Control vulnerability in debug/pprof endpoints Affected: >= 4.78.0, < 4.78.3; >= 4.77.0, < 4.77.1; >= 4.76.0, < 4.76.2; >= 4.75.0, < 4.75.2; < 4.53.3 |
| CVE-2022-24841 | 8.1 | Apr 18 | fleetdm/fleet is an open source device management, built on osquery Affected: before 4.13 |
| CVE-2026-101045 | 8.0 | Sep 27 | Fleet Homebrew Cask OS Command Injection via Metadata Affected: before 2026-08-19 |
| CVE-2026-27806 | 7.8 | Apr 8 | Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit Affected: < 4.81.1 |
| CVE-2026-54245 | 7.6 | Aug 26 | Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database Affected: < 4.86.2 |
| CVE-2026-111924 | 7.5 | Oct 17 | Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression Affected: before 4.83.0 |
| CVE-2026-111923 | 7.5 | Oct 17 | Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing Affected: before 4.89.0 |
| CVE-2026-46356 | 7.5 | May 14 | Fleet: IP spoofing allows bypassing API rate limiting Affected: < 4.80.1 |
| CVE-2026-24899 | 7.5 | May 14 | Fleet Windows MDM Azure AD JWT Authentication Bypass Affected: < 4.82.0 |
| CVE-2026-23998 | 7.5 | May 14 | Fleet has a Windows MDM management endpoint authentication bypass Affected: < 4.81.0 |
| CVE-2026-34391 | 7.5 | Mar 27 | Fleet Vulnerable to Windows MDM cross-device command disclosure Affected: < 4.81.1 |
| CVE-2026-34388 | 7.5 | Mar 27 | Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint Affected: < 4.81.0 |
| CVE-2026-26061 | 7.5 | Mar 27 | Fleet's unbounded request body read allows remote Denial of Service Affected: < 4.81.0 |
Showing 18