Nerveshub vulnerabilities

2 known vulnerabilities in Nerveshub from Nerves-hub. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  nerves_hub_web: Improper Authorization

  CVE-2026-28806Mar 10, 2026Nerves-hub

  Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bulk actions and device update API. Missing authorization checks in the device bulk actions and device update API endpoints allow authenticate

• 9.8 Critical severity

  nerves_hub_web: Use of Insufficiently Random Values

  CVE-2025-64097Jan 22, 2026Nerves-hub

  NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predict