GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: argo-workflows, src-fingerprint-fips, flux, witness, argo-events, chezmoi, external-secrets-operator-fips, skaffold, k9s-fips, argo-cd, gptscript, grype-fips, kubescape-server, pulumi, gitlab-rails-ce-fips, syft, cloudbeat, melange, gitlab-rails-ce, gitsign, packer,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: dagger, steampipe, tfsec, xeol, kyverno, syft, kaniko, gitsign, kubevela, nuclei, rancher-fleet, guac, gitaly, pulumi-language-yaml, argo-workflows, kubescape, bom, flux-source-controller, apko, argo-events, chezmoi, grype, argocd-image-updater, pulumi-language-dotne...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: dagger, steampipe, tfsec, xeol, kyverno, syft, kaniko, gitsign, kubevela, nuclei, rancher-fleet, guac, gitaly, pulumi-language-yaml, argo-workflows, kubescape, bom, flux-source-controller, apko, argo-events, chezmoi, grype, argocd-image-updater, pulumi-language-dotne...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: dagger, steampipe, tfsec, xeol, kyverno, syft, kaniko, gitsign, kubevela, nuclei, rancher-fleet, guac, gitaly, pulumi-language-yaml, argo-workflows, kubescape, bom, flux-source-controller, apko, argo-events, chezmoi, grype, argocd-image-updater, pulumi-language-dotne...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: dagger, steampipe, tfsec, xeol, kyverno, syft, kaniko, gitsign, kubevela, nuclei, rancher-fleet, guac, gitaly, pulumi-language-yaml, argo-workflows, kubescape, bom, flux-source-controller, apko, argo-events, chezmoi, grype, argocd-image-updater, pulumi-language-dotne...

GHSA-4F9R-X588-PP2H Fleet's user account creation via invite does not enforce invited email address

Summary Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address whi...

EUVD-2026-16797

Fleet's user account creation via invite does not enforce invited email address...

GHSA-W254-4HP5-7CVV Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Summary A Denial of Service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Impact ...

EUVD-2026-16795

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint...

EUVD-2026-16756

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin...

GHSA-9P23-P2M4-2R4M Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

Summary A SQL Injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs v...

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

Summary A SQL Injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs v...

GHSA-V895-833R-8C45 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database

Summary A critical second-order SQL Injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment...

EUVD-2026-16754

Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database...

Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database

Summary A critical second-order SQL Injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment...

CVE-2026-34387

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root macOS/Linux or SYSTEM Windows on managed hosts when an uninstall is triggered for a crafted...

CVE-2026-34391

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets...

CVE-2026-34385

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user...

CVE-2026-34386

Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet...

CVE-2026-34388

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all...