abstra (>=1.8.8, <=2.5.1), adeso (>=0.0.1, <=0.0.4) +70 more potentially affected by CVE-2024-6866 via flask-cors (4.0.0)

flask-cors PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - abstra =1.8.8, =0.0.1, =0.0.1, =0.0.6.dev1, =0.1.2, =0.0.7, =0.2.18, =0.1.0, =51.9.7, =0.0.25, =0.0.10, =0.0.12 and more Source cves:...

comet-common (>=1.0.5, <=2.0.3), comet-core (>=1.0.4, <=2.0.1) +5 more potentially affected by CVE-2024-6866 via flask-cors (3.0.4)

flask-cors PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - comet-common =1.0.5, =1.0.4, =0.4.4a3, =0.0.24, =0.4.0, =0.4.4a3, =0.4.4 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

appfly (>=0.1.0, <=2.1.0), boyaa-seed (>=0.1.1, <=0.1.6) +6 more potentially affected by CVE-2024-6866 via flask-cors (3.0.6)

flask-cors PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - appfly =0.1.0, =0.1.1, =0.0.8, =1.2.0, =0.1.3, =0.2.10, =0.10.0, =0.100.3 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

aberoth-ephemeris (>=1.0.0, <=1.1.0), agent-manager-sdk (>=0.1.1, <=0.1.2) +26 more potentially affected by CVE-2024-6866 via flask-cors (4.0.1)

flask-cors PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - aberoth-ephemeris =1.0.0, =0.1.1, =1.0.11a1, =1.5.3, =0.1.28, =3.11.32, =1.8.0, =0.7.5, =1.1.0, =12.0.17, =1.0.0, =0.6.2, =0.1.0, =0.1.3 and...

astaligner (>=0.1.0, <=1.0.2), cacaodocs (>=0.1.3, <=0.1.14) +30 more potentially affected by CVE-2024-6866 via flask-cors (5.0.0)

flask-cors PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - astaligner =0.1.0, =0.1.3, =0.1.0, =1.0.0a0, =0.1.0, =1.0.0, =1.5.8, =0.1.0, =0.0.10, =3.11.44, =3.3.4, =0.0.1, =0.0.3 and more Source cves:...

apilogicserver (>=1.4.0, <=5.3.33) potentially affected by CVE-2024-6866 via flask-cors (3.0.0)

flask-cors PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - apilogicserver =1.4.0, =5.3.33 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

ag-llama-api (>=0.0.1, <=0.0.31), ag-llama-api-s (>=0.0.4, <=0.0.12) +298 more potentially affected by CVE-2024-6866 via flask-cors (3.0.10)

flask-cors PYPI version 3.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - ag-llama-api =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =1.0.1, =4.1.0, =3.4.0, =4.0....

feather (>=0.0.6, <=0.0.8) potentially affected by CVE-2024-6866 via flask-cors (1.1.2)

flask-cors PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - feather =0.0.6, =0.0.8 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

Mageia: Security Advisory (MGASA-2025-0286)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Maximo Application Suite uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to CVE-2024-6866, CVE-2024-6839, CVE-2024-6.

Summary IBM Maximo Application Suite uses flaskcors-5.0.1-py3-none-any.whl which is vulnerable toCVE-2024-6866, CVE-2024-6839, CVE-2024-6.This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-6866 DESCRIPTION: corydolphin/flask-cors...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flaskcors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844 Vulnerability Details CVEID:CVE-2024-6866 DESCRIPTION: corydolphin/flask-cors version 4.01 contain...

CVE-2024-6866

creationtimestamp| type| source ---|---|--- 2025-05-23 22:39:43+00:00| seen| https://gist.github.com/EbonJaeger/4959b52b5b6898ca4e109d36bb8b6d36...

CVE-2024-6866 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, superset, kubeflow-jupyter-web-app...

altair-images (>=0.1.0, <=0.1.4), amundsen-common (>=0.14.0, <=0.15.3) +69 more potentially affected by CVE-2024-6866 via flask-cors (3.0.8)

flask-cors PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - altair-images =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =0.11.0, =0.9.0, =0.1.0, =0.2.2 and more Source cves:...

aact-openhands (>=0.0.4, <=0.0.5), agent-actions (>=0.1.0, <=0.1.8) +61 more potentially affected by CVE-2024-6866 via flask-cors (4.0.2)

flask-cors PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - aact-openhands =0.0.4, =0.1.0, =1.1.0b2, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =2.42.0, =0.1.0, =0.1.3 - cornflow 1.3.1rc2 and more Source...

comet-common (>=1.0.5, <=2.0.3), comet-core (>=1.0.4, <=2.0.1) +5 more potentially affected by CVE-2024-6866 via flask-cors (3.0.4)

flask-cors PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - comet-common =1.0.5, =1.0.4, =0.4.4a3, =0.0.24, =0.4.0, =0.4.4a3, =0.4.4 Source cves: CVE-2024-6866 Source advisory: OSV:GHSA-43QF-4RQW-9Q2G...

aberoth-ephemeris (>=1.0.0, <=1.1.0), agent-manager-sdk (>=0.1.1, <=0.1.2) +26 more potentially affected by CVE-2024-6866 via flask-cors (4.0.1)

flask-cors PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - aberoth-ephemeris =1.0.0, =0.1.1, =1.0.11a1, =1.5.3, =0.1.28, =3.11.32, =1.8.0, =0.7.5, =1.1.0, =12.0.17, =1.0.0, =0.6.2, =0.1.0, =0.1.3 and...

CVE-2024-6866

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

CVE-2024-6866 Case-Insensitive Path Matching in corydolphin/flask-cors

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the trymatch function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching...

CVE-2024-6866

CVE-2024-6866 concerns corydolphin/flask-cors. The issue arises from using the host-oriented try_match for path matching, making path comparisons effectively case-insensitive while URLs are case-sensitive. This can allow unauthorized origins to access restricted paths and potentially expose data....