Unblu vulnerabilities
We track 4 vulnerabilities in Unblu products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Unblu vulnerabilities
- 8.6 High severity
Unblu Spark: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in
- 9.3 Critical severity
Unblu Spark: Authorization Bypass Through User-Controlled Key
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration prop
- 9.3 Critical severity
Unblu Spark: Improper Neutralization of Input During Web Page Generation
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any J
- 7.0 High severity
Unblu Spark: Authorization Bypass Through User-Controlled Key
An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another con