github.com/fleetdm/fleet/v4 vulnerabilities — 57 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated Column Injection Vulnerability in Fleet Package: ORDER BY Column Injection on Activity List Endpoints github.com/fleetdm/fleet/v4 Go 25 Aug 2026 4.89.0
Unrated Unauthenticated Download Vulnerability in Fleet Package: Predictable URLs Expose iOS App Binaries github.com/fleetdm/fleet/v4 Go 25 Aug 2026 4.87.0
Unrated CVE-2026-54245: SQL Injection Vulnerability in Fleet Package Allows Database Compromise github.com/fleetdm/fleet/v4 Go 25 Aug 2026 4.86.2
3.1 low Column Injection Vulnerability in Fleet Package: ORDER BY Manipulation Risk github.com/fleetdm/fleet/v4 Go 20 Aug 2026 4.89.0
5.3 medium Unauthenticated Download Vulnerability in Fleet Package: Exposing In-House iOS App Binaries github.com/fleetdm/fleet/v4 Go 20 Aug 2026 4.87.0
Unrated CVE-2026-48786: Fleet Package Vulnerability Allows Observer-Class Users to Access Sensitive Configuration Data github.com/fleetdm/fleet/v4 Go 18 Aug 2026 4.87.0
6.5 medium CVE-2026-48786: Fleet Package Exposes Sensitive Team Configuration to Observer-Class Users github.com/fleetdm/fleet/v4 Go 12 Aug 2026 4.87.0
Unrated CVE-2026-41262: Fleet DM Cross-Team Policy Data Exposure Vulnerability github.com/fleetdm/fleet/v4 Go 07 Jul 2026 4.85.0
4.3 medium CVE-2026-41262: Fleet DM Global Policy Data Exposure Vulnerability github.com/fleetdm/fleet/v4 Go 26 Jun 2026 4.85.0
Unrated CVE-2026-26062: Unexpected Termination in Fleet Server due to gRPC Request Handling github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.81.0
Unrated CVE-2026-27806: Local Privilege Escalation in Fleet Due to Tcl Command Injection github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.81.1
Unrated CVE-2026-46370: Fleet Package Vulnerability Leading to Observer-Level Enrollment Secret Extraction github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.84.2
Unrated CVE-2026-46371: github.com/fleetdm/fleet - Observer-level Enrollment Secret Extraction Vulnerability github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.84.2
Unrated CVE-2026-46356: IP Spoofing Vulnerability in github.com/fleetdm/fleet Allows API Rate Limiting Bypass github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.80.1
Unrated CVE-2026-24000: Rate Limiting Bypass in Fleet Package github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.80.1
Unrated CVE-2026-24899: Azure AD JWT Authentication Bypass in Fleet Windows MDM github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.82.0
Unrated CVE-2026-26191: OS Command Injection Vulnerability in Fleet Package github.com/fleetdm/fleet/v4 Go 25 Jun 2026 4.81.1
6.5 medium CVE-2026-46371: Fleet Vulnerability Allows Observer Role to Extract Sensitive Data via Apple MDM Commands Endpoint github.com/fleetdm/fleet/v4 Go 12 Jun 2026 4.84.2
6.5 medium CVE-2026-46370: Fleet Package Observer-Level Enrollment Secret Extraction Vulnerability github.com/fleetdm/fleet/v4 Go 12 Jun 2026 4.84.2
Unrated CVE-2026-23998: Authentication Bypass in github.com/fleetdm/fleet/v4 Windows MDM Management Endpoint github.com/fleetdm/fleet/v4 Go 26 May 2026 4.81.0
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.