1349 matches found
PT-2026-38459
Name of the Vulnerable Software and Affected Versions Yarbo firmware version 2.3.9 Description The firmware contains hardcoded administrative credentials embedded in the image. These credentials are identical across all devices and cannot be modified or removed by end users, allowing unauthorized...
Bad Apples: Weaponizing native macOS primitives for movement and execution
As macOS adoption grows among developers and DevOps, it has become a high value target; however, native "living-off-the-land" LOTL techniques for the platform remain significantly under-documented compared to Windows. Adversaries can bypass security controls by repurposing native features like...
CVE-2026-33785
Junoirs OS on MX Series suffers a Missing Authorization vulnerability in the CLI that allows a local, authenticated user with low privileges to run specific 'request csds' commands. The commands are intended for high-privilege Juniper Device Manager (JDM) / CSDS roles and can impact all devices m...
Fleet Denial of Service Vulnerability (CNVD-2026-16892)
Fleet is Fleet Device Management open source a device management platform that supports a wide range of operating systems and devices to help IT and security teams with device management, vulnerability reporting, MDM and more. A denial of service vulnerability exists in Fleet versions prior to...
SUSE CVE-2026-34385
Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user...
SUSE CVE-2026-34386
Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet...
CVE-2026-32646
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
EUVD-2026-18845
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
CVE-2026-32646
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
CVE-2026-32646 Gardyn Cloud API Missing Authentication for Critical Function
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
CVE-2026-32646
CVE-2026-32646 concerns the Gardyn Cloud API where administrative endpoints (e.g., /api/admin/) lack proper authentication, exposing device management and internal admin communications. Multiple connected sources (Red Hat, CVE/CVE list, Circle, CVE writeups, and PT-2026-30214) corroborate a patte...
CVE-2026-32646
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
CVE-2026-32646 Gardyn Cloud API Missing Authentication for Critical Function
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
CVE-2026-32646: Missing Authentication for Critical Function
A specific administrative endpoint is accessible without proper authentication, exposing device management functions...
PT-2026-30214
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A specific administrative endpoint is accessible without proper authentication, which exposes device management functions. Recommendations At the moment, there i...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the Apple MDM profile delivery pipeline. An attacker can access or modify sensitive database contents, such as user credentials, API tokens, and device enrollment secrets, by sending a malicious UDID during the MDM...
GO-2026-4914 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet...
PT-2026-29953
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet...