https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:37:36 +0000 https://vulnerability.circl.lu/vuln/cve-2026-47725 <p><strong>Affected:</strong> juev nebula-mesh</p> <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party &lt;img src=&#34;.../ui/logout&#34;&gt; can force-trigger. This issue has been patched in version 0.3.3.</p> <p><strong>Affected:</strong> juev nebula-mesh</p> <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomain takeover); the GET /ui/logout route, which a third-party &lt;img src=&#34;.../ui/logout&#34;&gt; can force-trigger. This issue has been patched in version 0.3.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-47725