GHSA-GG4H-3HG2-GRPC vulnerabilities

Vulnerabilities for packages: unleash, kibana, opensearch-dashboards-fips, unleash-fips, opensearch-dashboards...

GHSA-6W3J-5FW6-R9VR vulnerabilities

Vulnerabilities for packages: unleash, kibana, opensearch-dashboards-fips, unleash-fips, opensearch-dashboards...

CVE-2026-84368 vulnerabilities

Vulnerabilities for packages: unleash, kibana, opensearch-dashboards-fips, unleash-fips, opensearch-dashboards...

CVE-2026-84367 vulnerabilities

Vulnerabilities for packages: unleash, kibana, opensearch-dashboards-fips, unleash-fips, opensearch-dashboards...

GHSA-2X7J-588G-CCC2 vulnerabilities

Vulnerabilities for packages: unleash, langfuse, kibana, langfuse-fips, unleash-fips...

GHSA-8M3C-C648-2XJJ vulnerabilities

Vulnerabilities for packages: unleash, langfuse, kibana, langfuse-fips, unleash-fips...

GHSA-CC9R-2J5M-2M83 vulnerabilities

Vulnerabilities for packages: unleash, langfuse, kibana, langfuse-fips, unleash-fips...

GHSA-WMMP-3585-3RMP vulnerabilities

Vulnerabilities for packages: unleash, langfuse, kibana, langfuse-fips, unleash-fips...

CVE-2026-84371 vulnerabilities

Vulnerabilities for packages: tensorflow-gpu-jupyter, unleash-fips, unleash...

GHSA-G8QQ-57P8-GGW5 vulnerabilities

Vulnerabilities for packages: tensorflow-gpu-jupyter, unleash-fips, unleash...

GHSA-JQFF-G426-HQXP vulnerabilities

Vulnerabilities for packages: nextcloud-server, keep-fips, unleash-proxy, gitlab-rails-ce, wazuh-dashboard, prism, arangodb, wazuh-dashboard-fips, langfuse, langfuse-fips, tensorflow-gpu-jupyter, tileserver-gl, kibana, unleash-fips, yaml-language-server, unleash, keep, gitlab-rails-ce-fips,...

GHSA-FPH4-WMHF-6FWF vulnerabilities

Vulnerabilities for packages: nextcloud-server, keep-fips, unleash-proxy, wazuh-dashboard, prism, arangodb, wazuh-dashboard-fips, langfuse, langfuse-fips, tensorflow-gpu-jupyter, tileserver-gl, kibana, unleash-fips, yaml-language-server, unleash, keep, gitlab-rails-ce-fips,...

CVE-2026-82659 vulnerabilities

Vulnerabilities for packages: unleash, langfuse, kibana, langfuse-fips, librechat, unleash-fips, jitsucom-jitsu...

GHSA-H3HJ-CMCX-XC66 vulnerabilities

Vulnerabilities for packages: unleash, langfuse, kibana, langfuse-fips, librechat, unleash-fips, jitsucom-jitsu...

GHSA-X5FP-WJ9C-MXMX vulnerabilities

Vulnerabilities for packages: unleash-proxy, code-server, gitlab-rails-ce, wazuh-dashboard, dotstatsuite-supercore, azurite, pelias-api, sqlpad, prism, arangodb, wazuh-dashboard-fips, langfuse, langfuse-fips, json-server, redisinsight, tileserver-gl, kibana, renovate, unleash-fips,...

CVE-2026-63004

creationtimestamp| type| source ---|---|--- 2026-08-21 20:35:02+00:00| published-proof-of-concept| https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj 2026-08-22 11:31:40+00:00| seen| https://gist.github.com/alon710/d92488505ce17a941a9b8015b1dda8cf...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63462

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding...

CVE-2026-63004

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

GHSA-W4MQ-XH27-6XPX Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...