{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"20250810"}],"component":"dfir-unfurl","cve_ids":["CVE-2026-40035"],"ecosystem":"PyPI","epss":0.00557,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vg9h-jx4v-cwx2","id":"tcs_01M5KG04W6TWM19165QY40W02Z","modified_at":"2026-07-08T08:26:45.753125542Z","published_at":"2026-01-29T15:32:33Z","references":["https://osv.dev/vulnerability/GHSA-vg9h-jx4v-cwx2","https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2","https://github.com/obsidianforensics/unfurl/commit/4c0a07ab1e9af3a1ddf0e7f47153ec9ba77946dd","https://github.com/obsidianforensics/unfurl"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-vg9h-jx4v-cwx2","url":"https://osv.dev/vulnerability/GHSA-vg9h-jx4v-cwx2"},{"source":"nvd","source_id":"CVE-2026-40035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40035"}],"summary":"Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)"}