nerves-hub vulnerabilities
8 published CVEs name nerves-hub among the affected products.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 3Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119446
Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
nerves-hub · nerves_hub_web
Critical9.4 - CVE-2026-120286
Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups
nerves-hub · nerves_hub_web
Medium5.3 - CVE-2026-120997
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
nerves-hub · nerves_hub_web
Low2.3 - CVE-2026-120730
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
nerves-hub · nerves_hub_web
High8.6 - CVE-2026-120999
Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else
nerves-hub · nerves_hub_web
High7.4 - CVE-2026-120295
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
nerves-hub · nerves_hub_web
High7.1 - CVE-2026-28806
Improper authorization in device bulk actions and device update API allows cross-organization device control
nerves-hub · nerves_hub_web
Critical9.4 - CVE-2025-64097
NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force
nerves-hub · nerves_hub_web
Critical9.5