{"items":[{"id":"CVE-2026-63464","published":"2026-09-04T19:44:10.117Z","updated":"2026-09-08T17:50:11.907Z","title":"Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`","severity":"HIGH","score":7.7,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-61699","published":"2026-09-04T19:43:28.633Z","updated":"2026-09-08T12:59:24.096Z","title":"nebula-mesh: Certificate revocation is never enforced at the mesh","severity":"HIGH","score":8.1,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2026-55513","published":"2026-09-04T19:43:18.876Z","updated":"2026-09-08T17:32:25.373Z","title":"nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens","severity":"MEDIUM","score":5.4,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2026-55512","published":"2026-09-04T19:41:50.326Z","updated":"2026-09-09T15:56:02.715Z","title":"nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting","severity":"MEDIUM","score":5.3,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2026-53604","published":"2026-09-04T19:40:51.423Z","updated":"2026-09-08T17:33:06.977Z","title":"nebula-mesh: CA private key not zeroized on web mobile-bundle error paths","severity":"HIGH","score":7.1,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-53603","published":"2026-09-04T19:40:31.548Z","updated":"2026-09-08T17:49:14.966Z","title":"nebula-mesh: Operator session tokens stored in plaintext in the database","severity":"HIGH","score":7.1,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-53602","published":"2026-09-04T19:40:16.908Z","updated":"2026-09-04T19:50:03.057Z","title":"nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate","severity":"MEDIUM","score":6.9,"vendor":"forgekeep","product":"nebula-mesh","kev":false,"epss":0.00309,"kevAdded":null}]}