799 matches found
CyberMeowfia
Sitio web: nebusec.ai ยท Twitter @nebusecurity ยท Lista de bugs 885+ Seguimiento de IonStack, sigue https://github.com/NebuSec/CyberMeowfia/issues/44 รltimas investigaciones IonStack parte II : GhostLock, un stack-UAF que ha existido en TODAS las distribuciones de Linux durante 15 aรฑos Linux Kernel...
nebula
Nebula Pentesting impulsado por IA El banco de trabajo Zero Layer Agradecimiento En primer lugar, quiero agradecer a Dios Todopoderoso, que es la fuente de todo conocimiento. Sin รl, esto no serรญa posible. Nebula reรบne las partes operativas de un compromiso de seguridad en una รบnica superficie de...
cve-2022-27255
CVE-2022-27255 - Desbordamiento de bรบfer en SIP ALG del SDK eCos de Realtek Este repositorio contiene los materiales para la charla "Explorando la superficie de ataque oculta de dispositivos IoT OEM: comprometiendo miles de routers con una vulnerabilidad en el SDK de Realtek para el sistema...
Nebula
Nebula Nebula es un marco de trabajo de Pruebas de Penetraciรณn en la Nube y con suerte DevOps. Estรก construido con mรณdulos para cada proveedor y cada funcionalidad. A partir de abril de 2021, solo cubre AWS, pero es un proyecto en curso y con suerte seguirรก creciendo para probar GCP, Azure,...
CVE-2026-43499-pja110
Website: nebusec.ai ยท Twitter @nebusecurity ยท Bug list 885+ Latest research IonStack part II : GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Linux Kernel ๐ Writeup ยท ๐ฆ Twitter Longinus : 2 Boundaries in One Bug, Piercing Chrome's Renderer and V8 Sandbox with a...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...
CVE-2026-61699
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...
CVE-2026-63464
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...
CVE-2026-53603
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...
CVE-2026-55512
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is reachable without authentication and is registered outside the Web UI rate-limited auth routes. Every request creates a fresh random OIDC...
CVE-2026-53602
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula certificate, because nebula-mgmt does not re-evaluate revocation/authorization state at certificate...
CVE-2026-55513
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...
CVE-2026-53604
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...
CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...
CVE-2026-63464
CVE-2026-63464 affects nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2 . The vulnerability is an SSRF that arises because non-admin operators (role user) can set allow_private: true on their own webhook subscription via POST/PATCH /api/v...
EUVD-2026-71721
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...
CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...
CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...
CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...
CVE-2026-61699 nebula-mesh: Certificate revocation is never enforced at the mesh
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...