FL
Product
fleet
41
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 6High 18Medium 16Low 1
Watch
Add fleet to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-46371 | 6.5 | Aug 26 | Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint Affected: < 4.84.2 |
| CVE-2026-46370 | 6.5 | Aug 26 | Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint Affected: < 4.84.2 |
| CVE-2026-48786 | 6.5 | Aug 26 | Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint Affected: < 4.87.0 |
| CVE-2026-26062 | 6.5 | May 14 | Fleet server may terminate unexpectedly when handling certain gRPC requests Affected: < 4.81.0 |
| CVE-2026-34389 | 6.5 | Mar 27 | Fleet's user account creation via invite does not enforce invited email address Affected: < 4.81.0 |
| CVE-2026-27465 | 6.5 | Feb 26 | Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users Affected: < 4.80.1 |
| CVE-2026-25963 | 6.5 | Feb 26 | Fleet: Authorization Bypass in certificate template batch deletion for team administrators Affected: < 4.80.1 |
| CVE-2022-23600 | 6.5 | Feb 4 | fleet is an open source device management, built on osquery Affected: before 4.9.1 |
| CVE-2026-23999 | 5.5 | Feb 26 | Fleet: Device lock PIN can be predicted if lock time is known Affected: < 4.80.1 |
| CVE-2026-22808 | 5.4 | Jan 21 | Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability Affected: >= 4.78.0, < 4.78.2; >= 4.77.0, < 4.77.1; >= 4.76.0, < 4.76.2; < 4.53.3 |
| CVE-2026-101047 | 5.3 | Sep 27 | Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs Affected: before 4.87.0 |
| CVE-2026-24000 | 5.3 | May 14 | Fleet has a rate limiting bypass via untrusted client IP headers Affected: < 4.80.1 |
| CVE-2026-24004 | 5.3 | Feb 26 | Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint Affected: < 4.80.1 |
| CVE-2026-103265 | 4.3 | Oct 1 | Fleet before 4.89.0 Information Disclosure via MDM Command Results Affected: before 4.89.0 |
| CVE-2026-101046 | 4.3 | Sep 27 | Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints Affected: before 4.89.0 |
| CVE-2026-41262 | 4.3 | Aug 26 | Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint Affected: < 4.85.0 |
Showing 16