Security
فارسی
All products

unleash-server

npm · Package
7 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Unleash: CR-approval email renders user-controlled raw HTMLCVE-2026-76909 · GHSA-7HVX-28GP-MF6J unleash-server npm Low Fix reported
Unleash: Missing await on permission check + cross-project IDOR in admin APICVE-2026-77426 · GHSA-72H8-WP98-7HCH unleash-server npm High Fix reported
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit logCVE-2026-77425 · GHSA-5FFH-6F9Q-5HHR unleash-server npm Medium Fix reported
Unleash: Clone-feature lets a user copy a feature from a project they cannot readCVE-2026-76910 · GHSA-8XCJ-9HFR-FH9J unleash-server npm Medium Fix reported
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernameCVE-2026-63466 · GHSA-W4MQ-XH27-6XPX unleash-server npm Medium Fix reported
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headersCVE-2026-63004 · GHSA-5VF6-JRQR-78FJ unleash-server npm Medium Fix reported
Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatterCVE-2026-63462 · GHSA-R5PQ-6CHH-J3XP unleash-server npm High Fix reported