Security
فارسی
All products

github.com/fleetdm/fleet/v4

Go · Package
32 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Fleet: ORDER BY column injection on activity list endpointsCVE-2026-101046 · GHSA-RXHG-VCWW-2MPWVersion ranges need review. github.com/fleetdm/fleet/v4 Go Low Fix reported
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLsCVE-2026-101047 · GHSA-Q9C5-PP7M-FM2GVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
SAML authentication vulnerability due to stdlib XML parsingCVE-2020-26276 · GHSA-W3WF-CFX3-6GCX github.com/fleetdm/fleet/v4 Go High Fix reported
Fleet has a rate limiting bypass via untrusted client IP headersCVE-2026-24000 · GHSA-J8H8-75H3-JG53Version ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet server may terminate unexpectedly when handling certain gRPC requestsCVE-2026-26062 · GHSA-X67P-9M2R-FXQVVersion ranges need review. github.com/fleetdm/fleet/v4 Go High Fix reported
Fleet: IP spoofing allows bypassing API rate limitingCVE-2026-46356 · GHSA-MXMP-WR3W-RVQXVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databaseCVE-2026-54245 · GHSA-7Q96-F8XW-JV5J github.com/fleetdm/fleet/v4github.com/fleetdm/fleet Go High Fix reported
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpointCVE-2026-48786 · GHSA-88P2-JJ8W-J8QGVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read EndpointCVE-2026-41262 · GHSA-GM7F-V959-FR2GVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet Affected by Local Privilege Escalation via Tcl Command Injection in OrbitCVE-2026-27806 · GHSA-RPHV-H674-5HP2Version ranges need review. github.com/fleetdm/fleet/v4 Go High Fix reported
Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointCVE-2026-46371 · GHSA-X4QR-QW6H-WVXQVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointCVE-2026-46370 · GHSA-VXM7-9X8V-8GM4Version ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet vulnerable to OS command injection in software packagesCVE-2026-26191 · GHSA-9VCR-G537-3W5VVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet Windows MDM Azure AD JWT Authentication BypassCVE-2026-24899 · GHSA-FFG9-J72F-J6XMVersion ranges need review. github.com/fleetdm/fleet/v4 Go High Fix reported
Fleet has a Windows MDM management endpoint authentication bypassCVE-2026-23998 · GHSA-2RC4-7JC6-QFFHVersion ranges need review. github.com/fleetdm/fleet/v4 Go High Fix reported
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpointCVE-2026-34388 · GHSA-W254-4HP5-7CVVVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet's user account creation via invite does not enforce invited email addressCVE-2026-34389 · GHSA-4F9R-X588-PP2HVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
A Fleet team maintainer can transfer hosts from any team via missing source team authorizationCVE-2026-29180 · GHSA-M2H6-4XPQ-QW3MVersion ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported
Fleet's unbounded request body read allows remote Denial of ServiceCVE-2026-26061 · GHSA-99HJ-44VG-HFCPVersion ranges need review. github.com/fleetdm/fleet/v4 Go High Fix reported
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the databaseCVE-2026-34385 · GHSA-V895-833R-8C45Version ranges need review. github.com/fleetdm/fleet/v4 Go Medium Fix reported