Unleash has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was September 2026 with 4. The median CVSS is 4.8 (medium). The most common weakness class is CWE-639 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-76910Medium· 5.3Unleash is an open-source feature management platform41CVE-2026-77426High· 7.1Unleash is an open-source feature management platform39CVE-2026-77425Medium· 4.3Unleash is an open-source feature management platform36CVE-2026-76909Low· 2.1Unleash is an open-source feature management platform12
Unleash vulnerabilities
CVEs affecting Unleash, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-76910Medium· 5.3PoCUnleash is an open-source feature management platform
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the s…
CVE-2026-76909Low· 2.1Unleash is an open-source feature management platform
Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTit…
CVE-2026-77426High· 7.1Unleash is an open-source feature management platform
Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting …
CVE-2026-77425Medium· 4.3PoCUnleash is an open-source feature management platform
Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUp…