Juev vulnerabilities
We track 5 vulnerabilities in Juev products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.
Latest Juev vulnerabilities
- 8.8 High severity
nebula-mesh: Authorization Bypass Through User-Controlled Key
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes
- 7.1 High severity
nebula-mesh: Improper Authorization
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit
- 9.9 Critical severity
nebula-mesh: Missing Authorization
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/
- 7.1 High severity
nebula-mesh: Improper Restriction of Rendered UI Layers or Frames
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`,
- 8.7 High severity
nebula-mesh: Improper Control of Generation of Code
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` tha