nerves_hub_web vulnerabilities and CVEs

Known vulnerabilities affecting nerves_hub_web, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

6 vulnerabilities tracked.

9.4 Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token… CVE-2026-119446 10 Nov 2026
8.6 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key… CVE-2026-120730 10 Nov 2026
7.4 Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerveshubweb allows an attacker who registers… CVE-2026-120999 10 Nov 2026
7.1 Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerveshubweb allows an authenticated user with the manage… CVE-2026-120295 10 Nov 2026
5.3 Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated… CVE-2026-120286 10 Nov 2026
2.3 Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb… CVE-2026-120997 10 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that nerves_hub_web is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here