Threat Intelligence Database

CVE-2026-14933 is a high-severity cross-site scripting (XSS) vulnerability in Unblu inc. Unblu Spark versions 7.0 through 7.57.7 and 8.0 through 8.39.2. It affects both on-premises and cloud deployments. An unauthenticated remote attacker in the visitor role can execute arbitrary JavaScript in the browser of an agent participating in the attacker's co-browsing session. Exploitation requires the agent to join the embedded co-browsing session. Mobile co-browsing is not affected.

CVE-2026-9589 is a critical missing authorization vulnerability in Unblu inc. Unblu Spark Collaboration Server versions 7.0 through 8.36.1-hotfix.0. It allows an authenticated remote attacker to read and modify configuration properties of entities they are not authorized to access, including other users, accounts, and in cloud deployments, other customers' accounts. The flaw arises because the server does not verify whether the user has access rights to the targeted configuration entity. Exploitation requires an authenticated session but no further user interaction.