unfurl vulnerabilities
CVEs whose affected-version data names the unfurl package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-40035Critical· 9.1PoCUnfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-em…
▾ Abyssalryandfir · unfurlEPSS 0.56%via NVD
CVE-2026-40036High· 7.5PoCUnfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service
Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/…
▾ Midnightryandfir · unfurlEPSS 0.51%via NVD