917 matches found
CVE-2026-44948
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...
CVE-2026-44948 Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...
CVE-2026-44948
CVE-2026-44948 describes a path traversal vulnerability in Rancher Fleet’s ImageScan subsystem, specifically in the GitRepo Path Handler. Affected versions are Rancher Fleet 0.12.0–0.12.16, 0.13.0–0.13.12, 0.14.0–0.14.7, and 0.15.0–0.15.3. The issue allows traversal outside the intended directory...
CVE-2026-44948
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...
CVE-2026-44949
A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submi...
CVE-2026-44949 Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook
A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submi...
GO-2026-5634 Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit in github.com/fleetdm/fleet
Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit in github.com/fleetdm/fleet...
GO-2026-5744 Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet
Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet...
GO-2026-5553 Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry
Tesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials in github.com/teslamotors/fleet-telemetry...
GO-2026-5520 Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet...
GO-2026-5455 Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet
Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet...
GO-2026-5358 Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet
Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet...
GO-2026-5301 Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet
Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet...
CVE-2026-57294
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...
CVE-2026-57295
A cross-site request forgery CSRF vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...
CVE-2026-57295
A cross-site request forgery CSRF vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...
CVE-2026-57295
CVE-2026-57295 describes a CSRF vulnerability in Jenkins EC2 Fleet Plugin (versions up to 4.2.3.539.v8fedff2a_81c3 and earlier). The issue lets an attacker cause Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained by another method, potentially captur...
CVE-2026-57295
A cross-site request forgery CSRF vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...
CVE-2026-57294
CVE-2026-57294 affects Jenkins EC2 Fleet Plugin version 4.2.3.539.v8fedff2a_81c3 and earlier, where a missing permission check allows an attacker with Overall/Read to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, potentially capturi...
EUVD-2026-38775
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins...