github.com/fleetdm/fleet/v4 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-41262Mediumgithub.com/fleetdm/fleet/v4: Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint CVE-2026-46371Mediumgithub.com/fleetdm/fleet/v4: Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint CVE-2026-46370Mediumgithub.com/fleetdm/fleet/v4: Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint CVE-2026-46356Mediumgithub.com/fleetdm/fleet/v4: Fleet: IP spoofing allows bypassing API rate limiting CVE-2026-26191Mediumgithub.com/fleetdm/fleet/v4: Fleet vulnerable to OS command injection in software packages CVE-2026-26062Highgithub.com/fleetdm/fleet/v4: Fleet server may terminate unexpectedly when handling certain gRPC requests CVE-2026-24899Highgithub.com/fleetdm/fleet/v4: Fleet Windows MDM Azure AD JWT Authentication Bypass CVE-2026-24000Mediumgithub.com/fleetdm/fleet/v4: Fleet has a rate limiting bypass via untrusted client IP headers CVE-2026-23998Highgithub.com/fleetdm/fleet/v4: Fleet has a Windows MDM management endpoint authentication bypass CVE-2026-27806Highgithub.com/fleetdm/fleet/v4: Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit CVE-2026-34389Mediumgithub.com/fleetdm/fleet/v4: Fleet's user account creation via invite does not enforce invited email address CVE-2026-34388Mediumgithub.com/fleetdm/fleet/v4: Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint CVE-2026-34386Mediumgithub.com/fleetdm/fleet/v4: Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin CVE-2026-34385Mediumgithub.com/fleetdm/fleet/v4: Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database CVE-2026-29180Mediumgithub.com/fleetdm/fleet/v4: A Fleet team maintainer can transfer hosts from any team via missing source team authorization CVE-2026-26061Highgithub.com/fleetdm/fleet/v4: Fleet's unbounded request body read allows remote Denial of Service CVE-2026-26060Mediumgithub.com/fleetdm/fleet/v4: Fleet: Password reset tokens remain valid after password change for 24 hours CVE-2026-27465Highgithub.com/fleetdm/fleet/v4: Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users CVE-2026-25963Mediumgithub.com/fleetdm/fleet/v4: Fleet: Authorization Bypass in certificate template batch deletion for team administrators CVE-2026-24004Mediumgithub.com/fleetdm/fleet/v4: Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint CVE-2026-23999Mediumgithub.com/fleetdm/fleet/v4: Fleet: Device lock PIN can be predicted if lock time is known CVE-2026-26186Mediumgithub.com/fleetdm/fleet/v4: Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter CVE-2026-23517Highgithub.com/fleetdm/fleet: Fleet has an Access Control vulnerability in debug/pprof endpoints CVE-2026-22808Mediumgithub.com/fleetdm/fleet: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability CVE-2025-27509Criticalgithub.com/fleetdm/fleet/v4: Fleet has SAML authentication vulnerability due to improper SAML response validation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo