SUSE CVE-2026-34388

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all...

SUSE CVE-2026-34389

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token...

GO-2026-4915 Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...

GO-2026-4889 Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet

Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2026-4888 Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet

Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-4912 Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet

Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet...

GO-2026-4913 Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet...

GO-2026-4914 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet

Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet...

GO-2026-4892 A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet

A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet...

PT-2026-29955

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...

PT-2026-29953

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet...

PT-2026-29954

Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet...

PT-2026-29935

Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

PT-2026-29936

Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

PT-2026-29939

A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: trivy-operator, amazon-ssm-agent-fips, packer, pulumi, melange, chainctl, scorecard, gitsign, trufflehog, crossplane, grype-db, apko, k9s-fips, flux-fips, pulumi-kubernetes-operator, cerbos-fips, skaffold, argo-cd, gitlab-rails-ce, rancher-fleet, tfsec, syft,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: kubescape, k9s, tfsec, witness, flux-source-controller, skaffold, trivy-operator, bom, kots, gitsign, dagger, trufflehog, zarf, flux, pulumi-language-dotnet, grafana-alloy, scorecard, snyk-cli, cerbos, osv-scanner, teleport, grype, kaniko, gitaly, wolfictl,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: kubescape, k9s, tfsec, witness, flux-source-controller, skaffold, trivy-operator, bom, kots, gitsign, dagger, trufflehog, zarf, flux, pulumi-language-dotnet, grafana-alloy, scorecard, snyk-cli, cerbos, osv-scanner, teleport, grype, kaniko, gitaly, wolfictl,...