nerves_hub_web — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in nerves_hub_web, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-119446	Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token CWE-384	9.4	Critical	2026-11-10
CVE-2026-120286	Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups CWE-862	5.3	Medium	2026-11-10
CVE-2026-120997	Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role CWE-1464	2.3	Low	2026-11-10
CVE-2026-120730	Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware CWE-639	8.6	High	2026-11-10
CVE-2026-120999	Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else CWE-287	7.4	High	2026-11-10
CVE-2026-120295	Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware CWE-863	7.1	High	2026-11-10
CVE-2026-28806	Improper authorization in device bulk actions and device update API allows cross-organization device control CWE-285	8.8^AI	High ^AI	2026-03-10
CVE-2025-64097	NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force CWE-330	8.1^AI	High ^AI	2026-01-22

All 8 known CVE vulnerabilities affecting nerves_hub_web with full Chinese analysis, references, and POCs where available.