FL
Vendor
fleetdm
41
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111924 | FL fleet fleetdm | 7.5 | Oct 17 | Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression |
| CVE-2026-111923 | FL fleet fleetdm | 7.5 | Oct 17 | Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing |
| CVE-2026-103265 | FL fleet fleetdm | 4.3 | Oct 1 | Fleet before 4.89.0 Information Disclosure via MDM Command Results |
| CVE-2026-103264 | FL fleet fleetdm | 9.1 | Oct 1 | Fleet before 4.87.0 Authentication Bypass via Device Identifiers |
| CVE-2026-101047 | FL fleet fleetdm | 5.3 | Sep 27 | Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs |
| CVE-2026-101046 | FL fleet fleetdm | 4.3 | Sep 27 | Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints |
| CVE-2026-101045 | FL fleet fleetdm | 8.0 | Sep 27 | Fleet Homebrew Cask OS Command Injection via Metadata |
| CVE-2026-54245 | FL fleet fleetdm | 7.6 | Aug 26 | Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database |
| CVE-2026-46371 | FL fleet fleetdm | 6.5 | Aug 26 | Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint |
| CVE-2026-46370 | FL fleet fleetdm | 6.5 | Aug 26 | Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint |
| CVE-2026-41262 | FL fleet fleetdm | 4.3 | Aug 26 | Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint |
| CVE-2026-48786 | FL fleet fleetdm | 6.5 | Aug 26 | Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint |
| CVE-2026-46356 | FL fleet fleetdm | 7.5 | May 14 | Fleet: IP spoofing allows bypassing API rate limiting |
| CVE-2026-26191 | FL fleet fleetdm | 9.8 | May 14 | Fleet vulnerable to OS command injection in software packages |
| CVE-2026-26062 | FL fleet fleetdm | 6.5 | May 14 | Fleet server may terminate unexpectedly when handling certain gRPC requests |
| CVE-2026-24899 | FL fleet fleetdm | 7.5 | May 14 | Fleet Windows MDM Azure AD JWT Authentication Bypass |
| CVE-2026-24000 | FL fleet fleetdm | 5.3 | May 14 | Fleet has a rate limiting bypass via untrusted client IP headers |
| CVE-2026-23998 | FL fleet fleetdm | 7.5 | May 14 | Fleet has a Windows MDM management endpoint authentication bypass |
| CVE-2026-27806 | FL fleet fleetdm | 7.8 | Apr 8 | Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit |
| CVE-2026-34391 | FL fleet fleetdm | 7.5 | Mar 27 | Fleet Vulnerable to Windows MDM cross-device command disclosure |
| CVE-2026-34389 | FL fleet fleetdm | 6.5 | Mar 27 | Fleet's user account creation via invite does not enforce invited email address |
| CVE-2026-34388 | FL fleet fleetdm | 7.5 | Mar 27 | Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint |
| CVE-2026-34387 | FL fleet fleetdm | 9.8 | Mar 27 | Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts |
| CVE-2026-34386 | FL fleet fleetdm | 8.8 | Mar 27 | Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin |
| CVE-2026-34385 | FL fleet fleetdm | 8.1 | Mar 27 | Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database |
| CVE-2026-29180 | FL fleet fleetdm | 8.8 | Mar 27 | Fleet's team maintainer can transfer hosts from any team via missing source team authorization |
| CVE-2026-26061 | FL fleet fleetdm | 7.5 | Mar 27 | Fleet's unbounded request body read allows remote Denial of Service |
| CVE-2026-26060 | FL fleet fleetdm | 8.8 | Mar 27 | Fleet: Password reset tokens remain valid after password change for 24 hours |
| CVE-2026-27465 | FL fleet fleetdm | 6.5 | Feb 26 | Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users |
| CVE-2026-25963 | FL fleet fleetdm | 6.5 | Feb 26 | Fleet: Authorization Bypass in certificate template batch deletion for team administrators |
| CVE-2026-23999 | FL fleet fleetdm | 5.5 | Feb 26 | Fleet: Device lock PIN can be predicted if lock time is known |
| CVE-2026-24004 | FL fleet fleetdm | 5.3 | Feb 26 | Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint |
| CVE-2026-26186 | FL fleet fleetdm | 8.8 | Feb 26 | Fleet has a SQL injection via backtick escape in ORDER BY parameter |
| CVE-2026-23518 | FL fleet fleetdm | 9.8 | Jan 21 | Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
| CVE-2026-23517 | FL fleet fleetdm | 8.1 | Jan 21 | Fleet has an Access Control vulnerability in debug/pprof endpoints |
| CVE-2026-22808 | FL fleet fleetdm | 5.4 | Jan 21 | Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
| CVE-2025-27509 | FL fleet fleetdm | 9.3 | Mar 6 | SAML authentication vulnerability due to improper SAML response validation |
| CVE-2022-24841 | FL Fleet Fleetdm | 8.1 | Apr 18 | fleetdm/fleet is an open source device management, built on osquery |
| CVE-2022-23600 | FL Fleet Fleetdm | 6.5 | Feb 4 | fleet is an open source device management, built on osquery |
| CVE-2021-21296 | FL Fleet Fleetdm | 2.7 | Feb 10 | Fleet is an open source osquery manager |
| CVE-2020-26276 | FL Fleet Fleetdm | 9.8 | Dec 17 | Fleet is an open source osquery manager |