Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by a sensitive information caching vulnerability due to Flask

Summary Flask is used by IBM Cloud Pak for Data System 1.0 as a WSGI web application framework. CVE-2026-27205 affects Flask's session handling, where certain forms of session object access such as the Python in operator fail to set the Vary: Cookie header, resulting in session-specific responses...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in flask-3.1.2-py3-none-any.whl

Summary IBM Watson Discovery Cartridge affected by vulnerability in flask-3.1.2-py3-none-any.whl Vulnerability Details CVEID:CVE-2026-27205 DESCRIPTION: Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205

Summary IBM Maximo Application Suite - Visual Inspection component uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-27205 DESCRIPTION: Flask is a web...

OESA-2026-2135 python-flask security update

Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks...

Security Bulletin: IBM Maximo Application Suite uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205.

Summary IBM Maximo Application Suite uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-5889 DESCRIPTION: A vulnerability was found in juliangruber...

Amazon Linux 2023 : python3-flask (ALAS2023-2026-1476)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1476 advisory. Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use o...

openSUSE Security Advisory (SUSE-SU-2026:0849-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

python311-Flask-3.1.3-1.1 on GA media (moderate)

python311-Flask-3.1.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:10264-1 Rating: moderate Cross-References: CVE-2026-27205 CVSS scores: CVE-2026-27205 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2026-27205 SUSE : 6...

arcor2 (>=0.22.0, <=0.23.1), arcor2-build (0.21.0) +81 more potentially affected by CVE-2026-27205 via flask (2.0.2)

flask PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - arcor2 =0.22.0, =0.3.0, =0.19.0, =0.14.0, =0.14.0, =0.7.0, =0.1.0, =0.1.2, =0.1.0, =0.1.2 and more Source cves: CVE-2026-27205 Source advisory:...

actinia-core (>=4.9.1, <=4.10.0), adeso (>=0.0.1, <=0.0.4) +106 more potentially affected by CVE-2026-27205 via flask (2.3.2)

flask PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - actinia-core =4.9.1, =0.0.1, =4.1.2, =9.1.32, =1.7.5, =0.1.0, =0.1.0, =0.2.0, =0.1.6, =0.1.0, =1.56.0.post1, =1.1.0, =1.3.4 and more Source cves:...

adop (>=0.0.1a1, <=0.0.1a5), analogic-framework (>=4.0.2, <=4.1.1) +67 more potentially affected by CVE-2026-27205 via flask (2.1.2)

flask PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - adop =0.0.1a1, =4.0.2, =2.6.0, =1.0.5, =3.1.0, =1.0.0, =1.0.1, =1.7.1, =2719.0.0, =1.2.3, =0.1.4.dev3, =0.1.4.dev9 and more Source cves: CVE-2026-2720...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), actinia-core (4.2.0) +682 more potentially affected by CVE-2026-27205 via flask (1.1.4)

flask PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.0rc3, =2022.9.19, =1.0.2, =0.1.1, =0.1.6, =1.0.7, =0.5.1, =0.2.0, =0.1.0, =1.0.0, =1.1.0 and more Sour...

aeros (>=2.0.0a1, <=2.0.0b4), alfworld (>=0.3.0rc1, <=0.3.0) +163 more potentially affected by CVE-2026-27205 via flask (2.0.3)

flask PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - aeros =2.0.0a1, =0.3.0rc1, =0.47.0, =0.10.0, =0.2.0, =0.19.1, =3.1.3, =1.61.0, =0.0.10, =3.0.0, =3.3.0 - burp-ui 1.0.0 - calculate-future-date 0.1.0 a...

adminui (1.5.2), adminui2 (>=1.5.2, <=1.5.3) +15 more potentially affected by CVE-2026-27205 via flask (2.1.0)

flask PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - adminui 1.5.2 - adminui2 =1.5.2, =1.0.0, =0.0.35, =0.13.0, =0.1.6, =0.12.0, =10.10.10, =1.0.0, =1.6.0 and more Source cves: CVE-2026-27205 Source...

aaz-dev (>=1.0.2, <=2.10.1), abilian-sbe (1.0.5) +172 more potentially affected by CVE-2026-27205 via flask (2.1.3)

flask PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - aaz-dev =1.0.2, =0.0.1b2, =5.0.1, =0.3.2, =1.5.0, =2.1.1.3, =0.0.7, =1.0.5, =0.2.40, =0.7.2, =0.7.6 and more Source cves: CVE-2026-27205 Source...

agentuniverse (>=0.0.6.dev1, <=0.0.7), docailite (>=0.4.0, <=0.6.0) +8 more potentially affected by CVE-2026-27205 via flask (2.2.0)

flask PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - agentuniverse =0.0.6.dev1, =0.4.0, =1.0.2, =0.0.3, =0.1.0, =4.6.1, =0.2.0, =2.0.0, =2.0.2 Source cves: CVE-2026-27205 Source advisory:...

abstra (>=1.8.26, <=2.5.1), aihqrating (>=0.0.3, <=0.0.7) +148 more potentially affected by CVE-2026-27205 via flask (2.2.2)

flask PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - abstra =1.8.26, =0.0.3, =2022.8.1, =0.1.0, =1.0.0, =2801.0.0, =7.0.1, =0.0.2, =1.0.0, =1.1.0 and more Source cves: CVE-2026-27205 Source advisory:...

assemblyline-ui (>=4.4.0.14, <=4.4.1.dev132), authentication-factory (0.0.1) +55 more potentially affected by CVE-2026-27205 via flask (2.2.3)

flask PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - assemblyline-ui =4.4.0.14, =0.1.0, =1.0.1, =1.1.0, =2.10.0, =1.0.9, =0.2.0, =4.3.0, =1.0.0b2, =1.0.0b16 - flask-ms-oauth2 1.0.0 and more Source cves:...

a-api-server (1.3.0), abi-ds-utils (1.0.1) +403 more potentially affected by CVE-2026-27205 via flask (2.2.5)

flask PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - a-api-server 1.3.0 - abi-ds-utils 1.0.1 - acceldata-o2a 1.0.0 - acryl-datahub-airflow-plugin =0.10.5.2rc3, =0.12.0, =0.2.1, =1.0.77, =0.8.2, =0.0.1,...

a2 (>=0.1.0, <=0.3.17), a62-emotion (>=0.10.0, <=0.11.4) +941 more potentially affected by CVE-2026-27205 via flask (2.3.3)

flask PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - a2 =0.1.0, =0.10.0, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.0.1, =0.1.30, =0.0.8.dev1, =0.0.3, =0.4.0, =0.1.0a1, =0.1.1, =0.6.0 and more Sourc...