Vulnerabilidades em fleetdm
41 resultadosAnálise Vexday
Fleet Device Management acumula 29 vulnerabilidades catalogadas, com 3 críticas (CVSS), mas nenhuma sob exploração ativa conhecida no momento. A fraqueza dominante é autenticação insuficiente (CWE-290), padrão recorrente que requer atenção na arquitetura; dos últimos 90 dias, 6 novas CVEs foram publicadas, sinalizando ritmo de descoberta consistente que demanda acompanhamento regular das correções.
CVE-2026-34386MEDIUMFleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global adminEPSS 0.3%CVE-2026-29180MEDIUMFleet's team maintainer can transfer hosts from any team via missing source team authorizationEPSS 0.3%CVE-2026-103264CRITICALFleet before 4.87.0 Authentication Bypass via Device IdentifiersEPSS 0.3%CVE-2026-41262MEDIUMFleet: Cross-Team Policy Data Exposure via Global Policy Read EndpointEPSS 0.3%CVE-2026-24004LOWFleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpointEPSS 0.3%CVE-2026-23517MEDIUMFleet has an Access Control vulnerability in debug/pprof endpointsEPSS 0.3%CVE-2026-46356MEDIUMFleet: IP spoofing allows bypassing API rate limitingEPSS 0.3%CVE-2026-27465LOWFleet: Sensitive Google Calendar credentials disclosed to low-privileged usersEPSS 0.3%CVE-2026-34388MEDIUMFleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpointEPSS 0.3%CVE-2026-23518CRITICALFleet has a JWT signature bypass vulnerability in Azure AD MDM enrollmentEPSS 0.3%CVE-2026-22808MEDIUMFleet Windows MDM endpoint has a Cross-site Scripting vulnerabilityEPSS 0.2%CVE-2026-101047MEDIUMFleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsEPSS 0.2%CVE-2026-23998HIGHFleet has a Windows MDM management endpoint authentication bypassEPSS 0.2%CVE-2026-25963LOWFleet: Authorization Bypass in certificate template batch deletion for team administratorsEPSS 0.2%CVE-2026-34385MEDIUMFleet's Apple MDM profile delivery has second-order SQL injection that can compromise the databaseEPSS 0.2%CVE-2026-103265MEDIUMFleet before 4.89.0 Information Disclosure via MDM Command ResultsEPSS 0.2%CVE-2026-34389MEDIUMFleet's user account creation via invite does not enforce invited email addressEPSS 0.2%CVE-2026-101046LOWFleet before 4.89.0 SQL Injection via ORDER BY Activity EndpointsEPSS 0.2%CVE-2026-34391MEDIUMFleet Vulnerable to Windows MDM cross-device command disclosureEPSS 0.2%CVE-2026-23999LOWFleet: Device lock PIN can be predicted if lock time is knownEPSS 0.1%