Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
51 results · page 1 of 2
Sep 8, 2026NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirectsCVE-2026-86550 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.5
NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.
- Product
- NebulaOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-63464 · Other software · forgekeep · reported by GitHubHigh 7.7
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the private/loopback/link-local SSRF guard — letting a low-privilege operator make the server request internal addresses. This issue has been patched in version 0.7.2.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-61699 · Other software · forgekeep · reported by GitHubHigh 8.1
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-55513 · Other software · forgekeep · reported by GitHubMedium 5.4
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollment_token_ttl security setting and per-network network_config.enrollment_token_ttl overrides. API host creation and token-regeneration paths use the configured TTL resolver, but POST /ui/hosts hardcodes now.Add(24 * time.Hour) for newly minted agent enrollment tokens. In deployments that intentionally reduce enrollment-token lifetime, any authenticated operator who can create a host through the Web UI can still mint a bearer enrollment token valid for about 24 hours. This issue has been patched in version 0.5.0.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-55512 · Other software · forgekeep · reported by GitHubMedium 5.3
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map for 10m. Expired states are swept lazily, but there is no rate limit or maximum live-state cap on the allocation path. An unauthenticated remote client can therefore grow OIDC.states for the full state TTL, bounded by request throughput rather than by configured auth rate limits. This issue has been patched in version 0.5.0.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-53604 · Other software · forgekeep · reported by GitHubHigh 7.1
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real *pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a *pki.CAManager, but Build never calls CAManager.Wipe() on any return path. As a result, when a mobile-bundle request goes through the web UI and Build returns — especially on error (missing network, invalid prefix, DB error, signing failure) — the plaintext CA private key remains on the Go heap, unwiped, until garbage collection. An attacker able to read process memory (core dump, swap, memory-scraping) can recover the CA signing key, which would allow minting arbitrary host certificates for the mesh. The API handler already does this correctly: it loads the CAManager, defer caMgr.Wipe(), and wraps it in caManagerResolver. Only the web path is affected. This issue has been patched in version 0.3.8.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-53603 · Other software · forgekeep · reported by GitHubHigh 7.1
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the token column is the PRIMARY KEY). The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. Anyone who can read the database (backup, snapshot, file copy, or SQL-level disclosure) obtains every active session token and can hijack operator sessions directly, with no further authentication. This issue has been patched in version 0.3.8.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN.CVE-2026-53602 · Other software · forgekeep · reported by GitHubMedium 6.9
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate issuance time — only at poll time. Firstly, the blocklist is not enforced at sign / re-enroll time. internal/api/enroll.go:128 calls caMgr.Sign(...) without consulting the blocklist. The blocklist is only checked in the poll path (internal/api/updates.go:57, fingerprintInBlocklist). The blocklist is keyed by certificate fingerprint (internal/store/sqlite.go), so a re-enrollment produces a new fingerprint that is not in the blocklist. Secondly, renewal does not re-validate operator / CA status. Auto-renewal at poll time (internal/api/updates.go:285-319, signHostCert) reads host.Name, host.Groups, host.NebulaIPs from the DB and re-signs without checking whether the owning operator is still active or the CA still valid. DisableOperator (internal/store/sqlite_operators.go) revokes sessions and API keys but does not retire the operator's CAs, and pki/signer.go checks only CA cert time-expiry, n
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4.CVE-2026-84165 · Other software · OpenNebula Systems · reported by cve-coordination@incibe.esHigh 8.7
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
- Product
- OpenNebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service.CVE-2026-81032 · Other software · vesoft-inc · reported by VulnCheckCritical 9.3
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.
- Product
- nebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers toCVE-2026-74238 · Other software · tier4 · reported by VulnCheckHigh 8.7
TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.
- Product
- nebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 28, 2026Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN.CVE-2026-49258 · Other software · juev · reported by GitHubHigh 8.8
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration or OIDC) can access resources belonging to other operators. The host create/edit/mobile-bundle/network-create paths and all CA-management routes were already correctly scoped. A malicious operator could block or delete any other operator's host, or read any operator's hosts and networks. This issue has been fixed in version 0.3.6.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-48058 · Other software · juev · reported by GitHubMedium 4.6
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin (operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session. This issue has been patched in version 0.3.2.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-47768 · Other software · juev · reported by GitHubMedium 5.5
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-47726 · Other software · juev · reported by GitHubHigh 7.1
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries (up to limit=1000). This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entries from rate-limit refusals — enough surface for a tenant to enumerate the server's activity, infer staffing patterns, or identify high-value targets. This issue has been patched in version 0.3.2.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-47725 · Other software · juev · reported by GitHubMedium 6.9
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party <img src=".../ui/logout"> can force-trigger. This issue has been patched in version 0.3.3.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-48025 · Other software · juev · reported by GitHubMedium 6.9
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package's contract (internal/keystore/keystore.go doc: "Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed") is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-47724 · Other software · juev · reported by GitHubCritical 9.9
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-47723 · Other software · juev · reported by GitHubHigh 7.1
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network.CVE-2026-47722 · Other software · juev · reported by GitHubHigh 8.7
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent's `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.
- Product
- nebula-mesh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later).CVE-2023-43688 · Other software · reported by MITREHigh 7.5
An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a Heap buffer overflow in various buffer encryption utilities.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later).CVE-2023-43686 · Other software · reported by MITREMedium 6.2
An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). A large number of Firefox preference files can cause the parser to ignore other browser configuration files, leading to a denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecCVE-2025-56537 · Other software · Opennebula · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopennebula.io
Apr 29, 2026A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted paylCVE-2025-56536 · Other software · Opennebula · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the user information parameter.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopennebula.io
Apr 29, 2026A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload intCVE-2025-56535 · Other software · Opennebula · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopennebula.io
Apr 29, 2026A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML CVE-2025-56534 · Other software · Opennebula · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopennebula.io
Mar 23, 2026Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces.CVE-2026-31851 · Other software · Nexxt Solutions · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.7
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrative credentials without restriction.
- Product
- Nebula 300+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnexxt-connectivity-frontend.s3.amazonaws.comnexxtsolutions.com
Mar 23, 2026Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, inCVE-2026-31850 · Other software · Nexxt Solutions · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 6.8
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. These backup files can be obtained through legitimate functionality or other weaknesses and do not apply encryption or hashing, allowing attackers to directly extract sensitive information.
- Product
- Nebula 300+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnexxt-connectivity-frontend.s3.amazonaws.comnexxtsolutions.com
Mar 23, 2026Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools andCVE-2026-31849 · Other software · Nexxt Solutions · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an authenticated administrator’s browser, leading to unauthorized configuration changes, including enabling services or modifying system settings.
- Product
- Nebula 300+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnexxt-connectivity-frontend.s3.amazonaws.comnexxtsolutions.com
Mar 23, 2026Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combiCVE-2026-31848 · Other software · Nexxt Solutions · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.7
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without proper authentication.
- Product
- Nebula 300+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnexxt-connectivity-frontend.s3.amazonaws.comnexxtsolutions.com
Mar 23, 2026Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a TelneCVE-2026-31847 · Other software · Nexxt Solutions · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.5
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23.
- Product
- Nebula 300+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnexxt-connectivity-frontend.s3.amazonaws.comnexxtsolutions.com
Mar 23, 2026Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attackCVE-2026-31846 · Other software · Nexxt Solutions · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.1
Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.
- Product
- Nebula 300+ / Tenda F3 V2.0 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnexxt-connectivity-frontend.s3.amazonaws.comnexxtsolutions.com
Mar 16, 2026A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android.CVE-2026-4217 · Other software · XREAL · reported by VulDBLow 1.1
A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to unprotected storage of credentials. The attack can only be performed from a local environment. The attack requires a high level of complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Nebula App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026Nebula is a scalable overlay networking tool.CVE-2026-25793 · Other software · slackhq · reported by GitHubHigh 7.6
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.
- Product
- nebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2025Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.CVE-2025-62820 · Other software · Slack · reported by MITREMedium 4.9
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
- Product
- Nebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later).CVE-2023-43687 · Other software · reported by MITREMedium 6.5
An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). There is a Race condition that leads to code execution because of a lack of locks between file verification and execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later).CVE-2023-43692 · Other software · reported by MITREHigh 7.5
An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). Out-of-bound reads in strings detection utilities lead to system crashes.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later).CVE-2023-43683 · Other software · reported by MITREMedium 6.5
An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). A Stack buffer out-of-bounds access exists because of an integer underflow when handling newline characters.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later).CVE-2023-43694 · Other software · reported by MITREMedium 5.2
An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). An Out of bounds read in several disassembling utilities causes stability issues and denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2025OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account tCVE-2025-54955 · Other software · OpenNebula · reported by MITREHigh 8.1
OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.
- Product
- OpenNebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opennebula.iogithub.com
Jun 26, 2025A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underCVE-2025-34047 · Other software · Beijing NetGuard Nebula Information Technology Co., Ltd. · reported by VulnCheckHigh 8.7
A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences to escape the intended directory and access sensitive files. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
- Product
- Leadsec SSL VPN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Dec 23, 2024A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress.CVE-2018-25106 · WordPress plugins & themes · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebula_send_to_hubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patch is named 41230a81db0f671c570c2644bc2f80565ca83c5a. It is recommended to apply a patch to fix this issue.
- Product
- webuidesigning NebulaX
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update webuidesigning NebulaX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 21, 2024An issue was discovered in vesoft NebulaGraph through 3.8.0.CVE-2024-47219 · Other software · vesoft · reported by MITRECritical 9.8
An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection.
- Product
- nebulagraph_studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024An issue was discovered in vesoft NebulaGraph through 3.8.0.CVE-2024-47218 · Other software · versoft · reported by MITRECritical 9.8
An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication.
- Product
- nebulagraph_studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2023Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.CVE-2023-36088 · Other software · Vesoft · reported by MITREHigh 7.5
Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
- Product
- Nebulagraph Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.CVE-2022-46080 · Other software · nexxtsolutions · reported by MITRECritical 9.8
Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.
- Product
- nebula1200-ac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnexxtsolutions.com
Oct 28, 2022Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection.CVE-2022-37426 · Other software · Opennebula · reported by secure@blackberry.comMedium 4.3
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopennebula.ioopennebula.io
Oct 28, 2022Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code InclCVE-2022-37425 · Other software · Opennebula · reported by secure@blackberry.comCritical 9.9
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopennebula.ioopennebula.io
Oct 28, 2022Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.CVE-2022-37424 · Other software · Opennebula · reported by secure@blackberry.comMedium 6.5
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.
- Product
- Opennebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopennebula.ioopennebula.io
Apr 2, 2020Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_CVE-2020-11498 · Other software · Slack · reported by MITREHigh 8.8
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context, e.g., for user-level persistence or to bypass security controls. NOTE: the vendor states that this "requires a high degree of access and other preconditions that are tough to achieve."
- Product
- Nebula
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.