36 matches found
CVE-2026-41262
creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:37+00:00| published-proof-of-concept| https://github.com/fleetdm/fleet/security/advisories/GHSA-gm7f-v959-fr2g...
GO-2026-5682 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet
Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet...
GO-2026-5744 Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet
Fleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet...
GO-2026-5520 Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
Fleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet...
GO-2026-5455 Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet
Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet...
GO-2026-5358 Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet
Fleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet...
GO-2026-5301 Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet
Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the windowsMDMManagement endpoint. An attacker can gain unauthorized access to management functionality by bypassing authentication mechanisms. Remediation Upgrade...
GO-2026-5002 Windows MDM management endpoint authentication bypass in github.com/fleetdm/fleet/v4
Windows MDM management endpoint authentication bypass in github.com/fleetdm/fleet/v4...
GO-2026-4889 Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet
Fleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2026-4888 Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet
Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
PT-2026-29955
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet...
PT-2026-29952
Fleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet...
Improper Check or Handling of Exceptional Conditions
Overview Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions via the launcher endpoint when an authenticated host sends an unexpected log type value. An attacker can cause the server process to terminate immediately, disrupting all connected...
GO-2026-4563 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the certificate template batch deletion process. An attacker can remove certificate templates belonging to other teams by supplying arbitrary team identifiers and template IDs to the API endpoint...
GO-2026-4334 Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet
Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet...
GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet...