Forgekeep

5 CVEs in 1 Forgekeep product, including Nebula-Mesh. Newest: CVE-2026-63464 (2026-09-04). Severity, EPSS and public exploits for each.

Forgekeep products with known CVEs

ProductCVEs
Nebula-Mesh5
Forgekeep CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-63464High7.72026-09-04nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow…
CVE-2026-61699High8.12026-09-04nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromi…
CVE-2026-55513Medium5.42026-09-04nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ign…
CVE-2026-55512Medium5.32026-09-04nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET /ui/oidc/login is r…
CVE-2026-536032026-09-04nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_s…