GO-2026-4914 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet

Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet...

PT-2026-29955

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...

PT-2026-29953

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet...

PT-2026-29954

Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet...

PT-2026-29935

Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

PT-2026-29936

Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

PT-2026-29939

A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitea, k9s, src-fingerprint, kubescape-server, commercial-chainloop-cli, cerbos-fips, rancher-fleet-fips, argocd-image-updater, argo-cd, kyverno-fips, syft-fips, grafana-alloy, trivy-fips, argo-events, argocd-image-updater-fips, google-osconfig-agent,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitea, k9s, src-fingerprint, kubescape-server, commercial-chainloop-cli, cerbos-fips, rancher-fleet-fips, argocd-image-updater, argo-cd, kyverno-fips, syft-fips, grafana-alloy, trivy-fips, argo-events, argocd-image-updater-fips, google-osconfig-agent,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitea, k9s, src-fingerprint, kubescape-server, commercial-chainloop-cli, cerbos-fips, rancher-fleet-fips, argocd-image-updater, argo-cd, kyverno-fips, syft-fips, grafana-alloy, trivy-fips, argo-events, argocd-image-updater-fips, google-osconfig-agent,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: scorecard, bom, flux-image-automation-controller, teleport, trivy, gitlab-runner, flux, chezmoi, guac, grype, zarf, pulumi, external-secrets-operator, apko, kubescape, nuclei, trufflehog, flux-source-controller, gomplate, pulumi-kubernetes-operator, crossplane,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: scorecard, bom, flux-image-automation-controller, teleport, trivy, gitlab-runner, flux, chezmoi, guac, grype, zarf, pulumi, external-secrets-operator, apko, kubescape, nuclei, trufflehog, flux-source-controller, gomplate, pulumi-kubernetes-operator, crossplane,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: scorecard, bom, flux-image-automation-controller, teleport, trivy, gitlab-runner, flux, chezmoi, guac, grype, zarf, pulumi, external-secrets-operator, apko, kubescape, nuclei, trufflehog, flux-source-controller, gomplate, pulumi-kubernetes-operator, crossplane,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: scorecard, bom, flux-image-automation-controller, teleport, trivy, gitlab-runner, flux, chezmoi, guac, grype, zarf, pulumi, external-secrets-operator, apko, kubescape, nuclei, trufflehog, flux-source-controller, gomplate, pulumi-kubernetes-operator, crossplane,...

GHSA-4F9R-X588-PP2H Fleet's user account creation via invite does not enforce invited email address

Summary Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address whi...

EUVD-2026-16797

Fleet's user account creation via invite does not enforce invited email address...

GHSA-W254-4HP5-7CVV Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Summary A Denial of Service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Impact ...

EUVD-2026-16795

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint...

EUVD-2026-16756

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin...

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

Summary A SQL Injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs v...