apilogicserver (>=3.1.15, <=4.0.6) potentially affected by CVE-2025-58065 via flask-appbuilder (3.3.0)

flask-appbuilder PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apilogicserver =3.1.15, =4.0.6 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2025-58065 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

apache-airflow (>=2.2.4rc1, <=2.2.5rc2), apilogicserver (>=5.2.15, <=5.3.33) potentially affected by CVE-2025-58065 via flask-appbuilder (3.4.4)

flask-appbuilder PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.2.4rc1, =5.2.15, =5.3.33 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2025-58065 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2025-58065 Source advisory:...

apache-airflow-backport-providers-papermill (>=2021.2.5rc1, <=2021.3.3) potentially affected by CVE-2025-58065 via flask-appbuilder (2.2.0)

flask-appbuilder PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow-backport-providers-papermill =2021.2.5rc1, =2021.3.3 Source cves: CVE-2025-58065 Source advisory:...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +6 more potentially affected by CVE-2025-58065 via flask-appbuilder (3.1.1)

flask-appbuilder PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - aglow =0.1.0rc3, =2022.9.19, =2.0.0b1, =1.4.0, =2.0.4 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plug...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +16 more potentially affected by CVE-2025-58065 via flask-appbuilder (3.4.5)

flask-appbuilder PYPI version 3.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =2.0.2rc1, =0.0.4rc1, =0.0.0, =0.5.2, =0.8.3a...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2025-58065 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

doc-tour (>=0.1.2, <=0.1.4) potentially affected by CVE-2025-58065 via flask-appbuilder (2.2.2)

flask-appbuilder PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - doc-tour =0.1.2, =0.1.4 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +138 more potentially affected by CVE-2025-58065 via flask-appbuilder (>=4.1.2, <=4.6.3)

flask-appbuilder PYPI version =4.1.2, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.2.1, =0.4.0, =0.1.0a1, =0.8.2, =0.1.1, =0.1.1, =1.10.6 - airflow-cyberark-secrets-backend 0.1.0 - airflow-dagfactory 0.19.1 and more Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +96 more potentially affected by CVE-2025-58065 via flask-appbuilder (2.3.4)

flask-appbuilder PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.7rc1, =2020.5.20rc1, =2021.2.5rc1,...

PYSEC-2026-1378 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create...

Flask-AppBuilder open redirect vulnerability using HTTP host injection

ImpactFlask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. PatchesFlask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicitly...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +138 more potentially affected by CVE-2025-32962 via flask-appbuilder (>=4.1.2, <=4.5.4)

flask-appbuilder PYPI version =4.1.2, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.2.1, =0.4.0, =0.1.0a1, =0.8.2, =0.1.1, =0.1.1, =1.10.6 - airflow-cyberark-secrets-backend 0.1.0 - airflow-dagfactory 0.19.1 and more Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...

PYSEC-2026-1379 Flask-AppBuilder open redirect vulnerability using HTTP host injection

Impact Flask-AppBuilder prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Patches Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS configuration variable, which allows administrators to explicit...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2025-32962 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2025-32962 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2025-32962 Source advisory:...

apache-airflow-backport-providers-papermill (>=2021.2.5rc1, <=2021.3.3) potentially affected by CVE-2025-32962 via flask-appbuilder (2.2.0)

flask-appbuilder PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow-backport-providers-papermill =2021.2.5rc1, =2021.3.3 Source cves: CVE-2025-32962 Source advisory:...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2025-32962 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

doc-tour (>=0.1.2, <=0.1.4) potentially affected by CVE-2025-32962 via flask-appbuilder (2.2.2)

flask-appbuilder PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - doc-tour =0.1.2, =0.1.4 Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...