https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:35:55 +0000 https://cve.radiocsirt.org/vuln/cve-2026-62283 <p><strong>Affected:</strong> nezhahq nezha</p> <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user&#39;s terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.</p> <p><strong>Affected:</strong> nezhahq nezha</p> <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user&#39;s terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.</p> https://cve.radiocsirt.org/vuln/cve-2026-62283