Ffleetdm

Products

Exploited and recent CVEs

• CVE-2026-111924 High 7.5 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression 0.4%
• CVE-2026-111923 High 7.5 Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing 0.4%
• CVE-2026-103265 Medium 4.3 Fleet before 4.89.0 Information Disclosure via MDM Command Results 0.2%
• CVE-2026-103264 Critical 9.1 Fleet before 4.87.0 Authentication Bypass via Device Identifiers 0.3%
• CVE-2026-101047 Medium 5.3 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs 0.2%
• CVE-2026-101046 Low 3.1 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints 0.2%
• CVE-2026-101045 High 8.0 Fleet Homebrew Cask OS Command Injection via Metadata 0.8%
• CVE-2026-54245 High 7.6 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database 0.6%
• CVE-2026-46371 Medium 6.5 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint 0.4%
• CVE-2026-46370 Medium 6.5 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint 0.4%
• CVE-2026-41262 Medium 4.3 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint 0.3%
• CVE-2026-48786 Medium 6.5 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint 0.4%
• CVE-2026-46356 Medium 6.9 Fleet: IP spoofing allows bypassing API rate limiting 0.3%
• CVE-2026-26191 Medium 6.0 Fleet vulnerable to OS command injection in software packages 0.8%
• CVE-2026-26062 High 8.7 Fleet server may terminate unexpectedly when handling certain gRPC requests 0.4%
• CVE-2026-24899 High 8.2 Fleet Windows MDM Azure AD JWT Authentication Bypass 0.4%
• CVE-2026-24000 Medium 6.9 Fleet has a rate limiting bypass via untrusted client IP headers 0.4%
• CVE-2026-23998 High 8.2 Fleet has a Windows MDM management endpoint authentication bypass 0.2%
• CVE-2026-27806 High 7.8 Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit 0.1%
• CVE-2026-34391 Medium 6.6 Fleet Vulnerable to Windows MDM cross-device command disclosure 0.2%
• CVE-2026-34389 Medium 4.9 Fleet's user account creation via invite does not enforce invited email address 0.2%
• CVE-2026-34388 Medium 6.6 Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint 0.3%
• CVE-2026-34387 Medium 5.7 Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts 1.3%
• CVE-2026-34386 Medium 6.3 Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin 0.3%
• CVE-2026-34385 Medium 6.2 Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database 0.2%
• CVE-2026-29180 Medium 4.9 Fleet's team maintainer can transfer hosts from any team via missing source team authorization 0.3%
• CVE-2026-26061 High 8.7 Fleet's unbounded request body read allows remote Denial of Service 0.5%
• CVE-2026-26060 Medium 6.0 Fleet: Password reset tokens remain valid after password change for 24 hours 0.3%
• CVE-2026-27465 Low 1.3 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users 0.3%
• CVE-2026-25963 Low 1.2 Fleet: Authorization Bypass in certificate template batch deletion for team administrators 0.2%