CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-40035 — Unfurl through 2025.08 contains an improper input validation vulnerability in co...

·Source: NIST NVD

Updated:

Executive Summary

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

Analysis

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution. CVSS Score: 9.1. Published: 2026-04-08T22:16:24.010.

Indicators of Compromise (1)

CVE (1)
CVE-2026-40035
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

Making the Case to the Board for Post-Quantum Readiness

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/making-case-to-board-for-post-quantum-readiness-image_small-1-a-33036.jpg" align=right hspace=4><b>Frame Quantum Risk Around Business Exposure, Timelines and Staged Investment</b><br>CIOs seeking board support for post-quantum readiness should skip the physics lesson. The stronger case connects vulnerable cryptography to critical

Bank Info Security
MEDIUMVulnerabilityNEW

China Could Coerce Taiwan by Hacking Comms, Think Tank Warns

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/war-game-tests-taiwans-telecom-backups-against-china-image_small-3-a-33034.jpg" align=right hspace=4><b>War Game Pits Taiwan's Telecom Sector Against China</b><br>A concerted Chinese attempt to take over neighboring Taiwan is more likely to involve "cyber-enabled economic warfare" rather than outright invasion, warns a Washington,

Bank Info Security
MEDIUMVulnerability

Oracle Health's Cerner EHR Breach Figure Soars to 20 Million

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/oracle-healths-cerner-ehr-server-hack-soars-to-20m-affected-image_small-10-a-33033.jpg" align=right hspace=4><b>Vendor Has Updated Breach Reports to Several States Including Texas</b><br>The number of patients affected in a 2025 hacking incident involving health data managed by electronic health record vendor Cerner has soared to

Bank Info Security