GHSA-vg9h-jx4v-cwx2
NoneCVSS
—
EPSS
—
Published
Jan 29, 2026
CISA due date
—
The record
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | dfir-unfurl | 0 | No fix |
Related vulnerabilities
- CVE-2026-40036 Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in… Also affects dfir-unfurl
- GHSA-h5qv-qjv4-pc5m Unfurl's unbounded zlib decompression allows decompression bomb DoS Also affects dfir-unfurl
- CVE-2026-6485 UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or… CWE-489
- CVE-2026-77545 A malicious actor with access to the network, low privileges and under certain conditions… CWE-489
- CVE-2026-66403 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. CWE-489
- CVE-2026-66405 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. CWE-489
- CVE-2026-54799 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-489
- CVE-2026-54798 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-489