CVE-2026-113613

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python...

CVE-2026-113613

FlexGet versions before 3.20.7 are vulnerable to a path traversal (Zip Slip) vulnerability within the decompress plugin . A remote attacker can exploit this by providing malicious zip or rar archives containing ../ sequences or absolute paths through a feed. This allows the attacker to write arbi...

EUVD-2026-105091

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2026-102598 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2026-102598 Source advisory:...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2026-21860 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2026-21860 Source advisory:...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-49766 Source advisory:...

flexget (>=2.18.5, <=2.21.24) potentially affected by CVE-2024-5569 via zipp (0.3.3)

zipp PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - flexget =2.18.5, =2.21.24 Source cves: CVE-2024-5569 Source advisory: OSV:PYSEC-2026-2074...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-34069 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-34069 Source advisory:...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2026-27199 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2026-27199 Source advisory:...

flexget (3.6.5), oarepo (11.0.28) +1 more potentially affected by CVE-2026-27205 via flask (2.2.4)

flask PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - flexget 3.6.5 - oarepo 11.0.28 - rapid-qc-ms =1.0.0, =1.1.0 Source cves: CVE-2026-27205 Source advisory: OSV:PYSEC-2026-2151...

flexget (3.6.5), oarepo (11.0.28) +1 more potentially affected by CVE-2026-27205 via flask (2.2.4)

flask PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - flexget 3.6.5 - oarepo 11.0.28 - rapid-qc-ms =1.0.0, =1.1.0 Source cves: CVE-2026-27205 Source advisory: OSV:GHSA-68RP-WP8R-4726...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2026-27199 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2026-27199 Source advisory:...

autorad (>=0.1.2, <=0.2.5), aws-flask-lambda (>=0.1.0, <=0.1.2) +54 more potentially affected by CVE-2026-21860 via werkzeug (2.0.2)

werkzeug PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - autorad =0.1.2, =0.1.0, =0.0.1, =0.9.2, =0.0.1, =0.1.0, =0.4.9, =3.1.141, =0.8.0.dev6, =1.0.0, =1.0.0, =0.16.0, =0.1.0, =1.0.0 and more Source...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2026-21860 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2026-21860 Source advisory:...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2025-66221 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2025-66221 Source advisory:...

bikeshed (4.1.0), c7n-policystream (0.4.32) +48 more potentially affected by CVE-2025-47273 via setuptools (69.0.2)

setuptools PYPI version 69.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - bikeshed 4.1.0 - c7n-policystream 0.4.32 - c7n-sphinxext 1.1.32 - candlestick-patterns =1.0.1, =0.0.157, =0.0.1, =0.1.35, =0.0.1, =3.10.2,...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-49766 Source advisory:...

flexget (>=2.18.5, <=2.21.24) potentially affected by CVE-2024-5569 via zipp (0.3.3)

zipp PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - flexget =2.18.5, =2.21.24 Source cves: CVE-2024-5569 Source advisory: OSV:GHSA-JFMJ-5V4G-7637...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-34069 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-34069 Source advisory:...

chaosmonkey (>=1.0.8, <=1.1.0), flexget (>=2.10.60, <=3.1.104) +10 more potentially affected by CVE-2024-1681 via flask-cors (3.0.2)

flask-cors PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - chaosmonkey =1.0.8, =2.10.60, =0.1.0rc0, =23.1.0, =3.0.2.dev1, =21.10.5, =0.6.0, =1.0.2, =1.0.5 Source cves: CVE-2024-1681 Source advisory:...