juev

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

juev records in CISA KEV

No juev vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2026-35226 CVE-2026-47725 · GHSA-273q-qgh5-wrj6

nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

HIGH 70

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00187 Published 2026-07-28 Fixed in 0.3.3 CWE-352

TI-2026-35227 CVE-2026-47726 · GHSA-qm33-p5p9-f8vg

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

MEDIUM 64

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00302 Published 2026-07-28 Fixed in 0.3.2 CWE-285

TI-2026-35499 CVE-2026-48058 · GHSA-rqfj-vv8r-xhqc

nebula-mesh: Session and OIDC state cookies lack the Secure attribute

MEDIUM 54

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00246 Published 2026-07-28 Fixed in 0.3.2 CWE-614

TI-2026-35225 CVE-2026-47724 · GHSA-598g-h2vc-h5vg

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

MEDIUM 43

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00481 Published 2026-07-23 Fixed in 0.3.4 CWE-862

TI-2026-36454 CVE-2026-49258 · GHSA-c6v2-3ffm-vcmc

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

MEDIUM 41

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00481 Published 2026-07-28 Fixed in 0.3.6 CWE-639

TI-2026-35223 CVE-2026-47722 · GHSA-7hp6-g3pq-3pc3

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

MEDIUM 40

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00467 Published 2026-07-23 Fixed in 0.3.2 CWE-94

TI-2026-35468 CVE-2026-48025 · GHSA-8h84-fhqq-q58v

nebula-mesh: Decrypted CA private key persists in heap after signing

LOW 37

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00507 Published 2026-07-28 Fixed in 0.3.7 CWE-244

TI-2026-35224 CVE-2026-47723 · GHSA-w7w5-5gcp-38rw

nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

LOW 32

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00526 Published 2026-07-23 Fixed in 0.3.1 CWE-1021

TI-2026-35265 CVE-2026-47768 · GHSA-9pg3-25fq-p6cc

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

LOW 24

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00154 Published 2026-07-28 Fixed in 0.3.2 CWE-598

Open these records in search →

Critical	1
High	4
Medium	4
Low	0
No CVSS	0