How many CVEs have a located fix in fleetdm/fleet?

14 published CVEs have a fix traced to functions in fleetdm/fleet, touching 101 functions across 46 files.

Which function in fleetdm/fleet has been patched by the most CVEs?

SearchTargets in server/service/targets.go has been changed by 1 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in fleetdm/fleet?

The median fix changes 37 lines. 21% of fixes change 20 lines or fewer, and 14% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

go

typescript

#412 of 500 repositories

fleetdm/fleet

Name: fleetdm/fleet: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 26, 2026

14

CVE fixes located

Published CVEs

101

Functions patched

Distinct function sites

46

Files patched

Distinct source files

2020–2026

Years covered

By CVE publication date

Overview

14 published CVEs have a fix traced to functions in fleetdm/fleet, the earliest published in 2020. Those fixes changed 101 distinct functions across 46 files, in 250 patch hunks.

Among the 500 repositories tracked here, fleetdm/fleet ranks #412 by the number of CVEs with a located fix.

Most patched functions

Functions in fleetdm/fleet changed by the most CVE fixes.

Most patched files

Files in fleetdm/fleet changed by the most CVE fixes.

1server/service/microsoft_mdm.go3 CVEs · 12 functions
2server/sso/validate.go3 CVEs · 7 functions
3pkg/mdm/mdmtest/windows.go2 CVEs · 9 functions
4server/mock/datastore_mock.go2 CVEs · 5 functions
5server/fleet/datastore.go2 CVEs · 1 functions
6server/service/users.go1 CVEs · 6 functions
7server/fleet/microsoft_mdm.go1 CVEs · 5 functions
8server/service/hosts.go1 CVEs · 5 functions
9server/datastore/mysql/microsoft_mdm.go1 CVEs · 4 functions
10server/service/global_schedule.go1 CVEs · 4 functions

Fix size

How much code a CVE fix in fleetdm/fleet changes, with backports counted once.

37

Median lines changed

Added plus removed, per CVE

21%

Fixes of 20 lines or fewer

Share of CVE fixes

14%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in fleetdm/fleet, and the functions each fix changed.

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
CVE-2026-48786SearchTargets
Medium · CVSS 6.5
EPSS 0.4%2026-08-26
Fleet has a Windows MDM management endpoint authentication bypass
CVE-2026-23998requestAuthState doManagementReq processIncomingMDMCmds
High · CVSS 8.2
EPSS 0.2%2026-05-14
Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
CVE-2026-27465GoogleCalendarApiKey stringify ModifyAppConfig
High · CVSS 7.1
EPSS 0.4%2026-02-26
Fleet: Authorization Bypass in certificate template batch deletion for team administrators
CVE-2026-25963GetCertificateTemplatesByIdsAndTeam GetCertificateTemplateById DeleteCertificateTemplateSpecs
Medium · CVSS 5.0
EPSS 0.3%2026-02-26
Fleet: Device lock PIN can be predicted if lock time is known
CVE-2026-23999GenerateRandomPin DeviceLock EraseDevice
Medium · CVSS 4.1
EPSS 0.1%2026-02-26
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint
CVE-2026-24004handlePubSubStatusReport authenticatePubSub checkIfAndroidNotConfigured
Medium · CVSS 6.3
EPSS 0.3%2026-02-26
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
CVE-2026-23518GetAzureAuthTokenClaims Close getToken
Critical · CVSS 9.3
EPSS 0.3%2026-01-21
Fleet has an Access Control vulnerability in debug/pprof endpoints
CVE-2026-23517Middleware
High · CVSS 7.1
EPSS 0.3%2026-01-21
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
CVE-2026-22808isValidAppru mdmMicrosoftAuthEndpoint NewSoapFault
Medium · CVSS 5.5
EPSS 0.3%2026-01-21
SAML authentication vulnerability due to improper SAML response validation
CVE-2025-27509validateSignature ValidateAudiences Validator
Critical · CVSS 9.3
EPSS 0.7%2025-03-06
CVE-2022-24841
CVE-2022-24841PackListOptions ChangeUserEmail setAuthCheckedOnPreAuthErr
High · CVSS 8.1
EPSS 0.8%2022-04-18
Limited ability to spoof SAML authentication with missing audience verification in Fleet
CVE-2022-23600ValidateResponse AudienceRestriction validator
Medium · CVSS 6.5
EPSS 0.9%2022-02-04

Get an alert for each new fleetdm/fleet CVE, with the patched functions and AI-written analysis.

Monitor fleet CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

AcademySoftwareFoundation/OpenImageIO14 CVEs ail-project/ail-framework14 CVEs android.googlesource.com/platform-external-libhevc14 CVEs apostrophecms/apostrophe14 CVEs assimp/assimp14 CVEs authzed/spicedb14 CVEs bigtreecms/BigTree-CMS14 CVEs canonical/lxd14 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in fleetdm/fleet.

How many CVEs have a located fix in fleetdm/fleet?: 14 published CVEs have a fix traced to functions in fleetdm/fleet, touching 101 functions across 46 files.
Which function in fleetdm/fleet has been patched by the most CVEs?: SearchTargets in server/service/targets.go has been changed by 1 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in fleetdm/fleet?: The median fix changes 37 lines. 21% of fixes change 20 lines or fewer, and 14% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track fleetdm/fleet CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing