nora vulnerabilities

CVEs whose affected-version data names the nora package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-59164High· 7.1PoC

1w ago

NORA missing cross-user token-management authorization

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/u…

▾ Midnightgetnora-io · noraEPSS 0.20%via CVEORG