ROOT-APP-PYPI-CVE-2023-30861 CVE-2023-30861 in Flask - Patched by Root

Root has patched CVE-2023-30861 in the Flask package for Root:PyPI. Multiple fixed versions available...

CVE-2026-71241

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CVE-2026-71241

CVE-2026-71241 affects a Book-Management-System built with Flask. Several endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) are missing the @login_required decorator that protects related routes (/search_student, /storage). This misconfiguration allows any unauthenticat...

CVE-2026-71241 Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

EUVD-2026-53314

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. This allows any unauthenticated remote user to retrieve student PII name,...

CVE-2026-71241 Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CVE-2026-71241

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. This allows any unauthenticated remote user to retrieve student PII name,...

CVE-2026-71241: Missing Authentication for Critical Function

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CLSA-2026-1781139191 TuxCare security update for flask-cors (1 CVE)

TuxCare rebuilt flask-cors to address 1 CVE. Fixed in 4.0.2.post2+tuxcare...

CLSA-2026-1772410250 TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.2.post1+tuxcare...

CLSA-2026-1772410252 TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 2.2.1.post1+tuxcare...

CLSA-2026-1772410251 TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.4.post1+tuxcare...

CLSA-2025-1759882315 TuxCare security update for flask-cors (1 CVE)

TuxCare rebuilt flask-cors to address 1 CVE. Fixed in 4.0.2.post1+tuxcare...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11112 – XXE via SVG Image Upload Program C...

Exploit for Use of Uninitialized Variable in Google Chrome

--- CVE-2026-11104 – Python SSTI via Jinja2 |attr Filter B...

SUSE CVE-2026-17350

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Openclaw

--- CVE-2026-4040 – Race Condition in File Upload Leading to...

CVE-2026-17350: Missing Authorization

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

BountySkiller

BountySkiller — hacktivity & writeup collector Flask app that...

The vulnerability of the FAB (Flask App Builder) authentication manager of the Apache Airflow network software allows a malicious individual to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the authentication manager of the Apache Airflow network software, Flask App Builder, is related to errors in verifying the cryptographic signature. Exploiting this vulnerability can allow an attacker to increase their privileges and gain unauthorized access to protected...