Forgekeep - vulnerabilities (CVEs)

7 CVEs in 1 products, 0 in the last 30 days, newest from 2026-09-04.

Products

CVE-2026-63464 - CVSS 7.7 (high), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set…
CVE-2026-61699 - CVSS 8.1 (high), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a…
CVE-2026-55513 - CVSS 5.4 (medium), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path…
CVE-2026-55512 - CVSS 5.3 (medium), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is…
CVE-2026-53604 - CVSS 7.1 (high), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real…
CVE-2026-53603 - CVSS 7.1 (high), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the…
CVE-2026-53602 - CVSS 6.9 (medium), 2026-09-04: nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer…