Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Unblu inc. Clear all filters
TI-2026-76785 CVE-2026-14933 · GHSA-9p8h-2662-3xvr

Cross-site scripting in Unblu Spark embedded co-browsing

Priority MEDIUM 40

Cross-site scripting in the embedded co-browsing feature in Unblu inc.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.0056 Published 2026-10-20 Fixed in 8.35.2-hotfix.0, 8.37.2-hotfix.2 +2 CWE-79
TI-2026-07180 CVE-2026-8152 · GHSA-6f3h-gqrm-69gc

Unblu Spark Open Redirect leading to DOM-Based XSS

Priority MEDIUM 40

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack.

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00414 Published 2026-07-22 Fixed in 8.36.1-hotfix.0, 8.37.0 CWE-601
TI-2025-03091 CVE-2025-3519 · GHSA-2m3f-82cc-h56x

Replace uploaded files knowing the file upload ID

Priority LOW 31

An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file.

CVSS 4.0HIGH 7.0 Network Low privileges No interaction EPSS 0.00298 Published 2025-04-22 Fixed in 8.13.1 CWE-639
TI-2025-03090 CVE-2025-3518 · GHSA-4mxw-7rp7-fhjr

File upload functionality possible even when disabled

Priority LOW 24

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00247 Published 2025-04-22 Fixed in 7.54.1, 8.13.1 CWE-284