agentprime: nerves-hub-nerves-hub-webEvery new CVE for nerves-hub-nerves-hub-web.https://agentprime.io/CVE-2026-119446: Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API tokenhttps://agentprime.io/advisories/CVE-2026-119446/https://agentprime.io/advisories/CVE-2026-119446/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Nov 2026 10:44:15 GMTCVEcriticalCVE-2026-120286: Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groupshttps://agentprime.io/advisories/CVE-2026-120286/https://agentprime.io/advisories/CVE-2026-120286/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Nov 2026 10:44:07 GMTCVECVE-2026-120997: Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old rolehttps://agentprime.io/advisories/CVE-2026-120997/https://agentprime.io/advisories/CVE-2026-120997/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Nov 2026 10:43:57 GMTCVECVE-2026-120730: Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmwarehttps://agentprime.io/advisories/CVE-2026-120730/https://agentprime.io/advisories/CVE-2026-120730/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Nov 2026 10:43:47 GMTCVECVE-2026-120999: Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone elsehttps://agentprime.io/advisories/CVE-2026-120999/https://agentprime.io/advisories/CVE-2026-120999/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Nov 2026 10:43:38 GMTCVECVE-2026-120295: Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmwarehttps://agentprime.io/advisories/CVE-2026-120295/https://agentprime.io/advisories/CVE-2026-120295/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Nov 2026 10:43:26 GMTCVECVE-2026-28806: Improper authorization in device bulk actions and device update API allows cross-organization device controlhttps://agentprime.io/advisories/CVE-2026-28806/https://agentprime.io/advisories/CVE-2026-28806/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 10 Mar 2026 21:30:58 GMTCVEcriticalCVE-2025-64097: NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Forcehttps://agentprime.io/advisories/CVE-2025-64097/https://agentprime.io/advisories/CVE-2025-64097/CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Jan 2026 14:57:00 GMTCVEcritical