Unleash vulnerabilities

Products

• Unleash 7

Newest

• unleash Unleash: Missing await on permission check + cross-project IDOR in admin API CVE-2026-77426 Fix available 7.1 HighSeptember 22, 2026
• unleash Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log CVE-2026-77425 Fix available 4.3 MediumSeptember 22, 2026
• unleash Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVE-2026-76910 Fix available 5.3 MediumSeptember 22, 2026
• unleash Unleash: CR-approval email renders user-controlled raw HTML CVE-2026-76909 Fix available 2.1 LowSeptember 22, 2026
• unleash Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username CVE-2026-63466 Fix available 4.1 MediumAugust 21, 2026
• unleash Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter CVE-2026-63462 Fix available 7.5 HighAugust 21, 2026
• unleash Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers CVE-2026-63004 Fix available 5.5 MediumAugust 21, 2026