nerves-hub — Vulnerabilities & Security Advisories 8

Browse all 8 CVE security advisories affecting nerves-hub. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Found 8 results / 8 Clear Filters

Top products by nerves-hub: nerves_hub_web

CVE ID	Title	CVSS	Severity	Published
CVE-2026-119446	Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token — nerves_hub_web CWE-384	9.4	Critical	2026-11-10
CVE-2026-120286	Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups — nerves_hub_web CWE-862	5.3	Medium	2026-11-10
CVE-2026-120997	Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role — nerves_hub_web CWE-1464	2.3	Low	2026-11-10
CVE-2026-120730	Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware — nerves_hub_web CWE-639	8.6	High	2026-11-10
CVE-2026-120999	Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else — nerves_hub_web CWE-287	7.4	High	2026-11-10
CVE-2026-120295	Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware — nerves_hub_web CWE-863	7.1	High	2026-11-10
CVE-2026-28806	Improper authorization in device bulk actions and device update API allows cross-organization device control — nerves_hub_web CWE-285	8.8^AI	High ^AI	2026-03-10
CVE-2025-64097	NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force — nerves_hub_web CWE-330	8.1^AI	High ^AI	2026-01-22

This page lists every published CVE security advisory associated with nerves-hub. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.