CVE-2026-2433

creationtimestamp| type| source ---|---|--- 2026-03-07 07:16:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2433 2026-03-07 10:08:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghlhl73vg2u...

The vulnerability of the Fleet Patching and Provisioning component of the Oracle Database Server system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Fleet Patching and Provisioning component of the Oracle Database Server management system is related to the disclosure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, sops, terraform-provider-grafana-fips, crossplane-provider-aws-s3, crossplane-provider-aws-rds, crossplane-provider-aws-sns, crossplane-provider-aws-ecr-fips, sops-fips, linkerd2, opa, crossplane-provider-aws-s3-fips,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, sops, terraform-provider-grafana-fips, crossplane-provider-aws-s3, crossplane-provider-aws-rds, crossplane-provider-aws-sns, crossplane-provider-aws-ecr-fips, sops-fips, linkerd2, opa, crossplane-provider-aws-s3-fips,...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the exec.approval requests. An attacker can gain unauthorized access to execute actions on unintended nodes by replaying approval requests across different node...

CVE-2026-28517

creationtimestamp| type| source ---|---|--- 2026-02-28 01:25:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfv2xflkle2z 2026-04-14 20:15:55+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendciminstallsqlirce.rb 2026-04-15...

CVE-2026-25963

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-23999

Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulting PIN could potentially be derived if...

CVE-2026-27465

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources...

CVE-2026-24004

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet...

CVE-2026-26186

Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the orderkey query parameter. Due to unsafe use of goqu.I when constructing the ORDER BY clause, specially crafted input...

GO-2026-4563 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet

Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet...

GO-2026-4561 Fleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet

Fleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet...

GO-2026-4557 Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter in github.com/fleetdm/fleet

Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter in github.com/fleetdm/fleet...

GO-2026-4560 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users in github.com/fleetdm/fleet

Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users in github.com/fleetdm/fleet...

GO-2026-4564 Fleet: Device lock PIN can be predicted if lock time is known in github.com/fleetdm/fleet

Fleet: Device lock PIN can be predicted if lock time is known in github.com/fleetdm/fleet...

GHSA-2V6M-6XW3-6467 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

Summary A vulnerability in Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources associated with the service account. Impact Fleet returns configuration da...

EUVD-2026-8829

Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: kyverno, apko, crossplane-provider-aws-sns, wal-g, hydra, zarf, trufflehog, snyk-cli, wolfictl, crossplane-provider-keycloak, policy-controller, zot, grafana, opentofu, aactl, q, helm, gptscript, goreleaser, crossplane-provider-azure-storage,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: kyverno, apko, crossplane-provider-aws-sns, wal-g, hydra, zarf, trufflehog, snyk-cli, wolfictl, crossplane-provider-keycloak, policy-controller, zot, grafana, opentofu, aactl, q, helm, gptscript, goreleaser, crossplane-provider-azure-storage,...