Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
MAL-2026-15566
  • PyPI/flask-header-guard
 Malicious code in flask-header-guard (PyPI) 29 Aug
  • No fix available
PYSEC-2026-3466
  • PyPI/flask-reuploaded
 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) 23 Jul
  • Fix available
  • Severity - 7.5 (High)
GHSA-937x-gpqr-72gg
  • PyPI/flask-reuploaded
 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) 17 Jul
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2026-2478
  • PyPI/flask-security-too
 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance 13 Jul
  • Fix available
GHSA-f66q-9rf6-8795
  • PyPI/flask-security-too
 Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion 07 Jul
  • No fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-1378
  • PyPI/flask-appbuilder
 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods 07 Jul
  • Fix available
  • Severity - 6.5 (Medium)
PYSEC-2026-1379
  • PyPI/flask-appbuilder
 Flask-AppBuilder open redirect vulnerability using HTTP host injection 07 Jul
  • Fix available
  • Severity - 4.3 (Medium)
PYSEC-2026-1377
  • PyPI/flask
 Flask uses fallback key instead of current signing key 07 Jul
  • Fix available
  • Severity - 1.8 (Low)
PYSEC-2026-1385
  • PyPI/flask-cors
 Flask-CORS allows for inconsistent CORS matching 07 Jul
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-1384
  • PyPI/flask-cors
 Flask-CORS improper regex path matching vulnerability 07 Jul
  • Fix available
  • Severity - 4.3 (Medium)
PYSEC-2026-1383
  • PyPI/flask-cors
 Flask-CORS vulnerable to Improper Handling of Case Sensitivity 07 Jul
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2026-1382
  • PyPI/flask-appbuilder
 Flask-AppBuilder's login form allows browser to cache sensitive fields 07 Jul
  • Fix available
  • Severity - 4.8 (Medium)
PYSEC-2026-1381
  • PyPI/flask-appbuilder
 Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS) 07 Jul
  • Fix available
  • Severity - 4.3 (Medium)
PYSEC-2026-1380
  • PyPI/flask-appbuilder
 Flask-AppBuilder Has No Rate Limiting on Login AUTH DB 07 Jul
  • Fix available
  • Severity - 7.5 (High)
PYSEC-2026-809
  • PyPI/flask-security
 Flask-Security vulnerable to Open Redirect 07 Jul
  • Fix available
  • Severity - 6.1 (Medium)
PYSEC-2026-635
  • PyPI/flask-appbuilder
 Open Redirect in Flask-AppBuilder 02 Jul
  • Fix available
  • Severity - 6.1 (Medium)
Load more...