CVE-2026-49471

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A D...

bentodev (>=0.1.17, <=2018.11.2), biweeklybudget (>=0.1.0, <=0.7.0) +4 more potentially affected by CVE-2026-21860 via werkzeug (0.12.1)

werkzeug PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - bentodev =0.1.17, =0.1.0, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2026-21860 Source advisory: OSV:PYSEC-2026-2044...

discourse-sso-oidc-bridge-consideratio (>=0.1.8, <=0.1.9), enochecker (0.0.5) +7 more potentially affected by CVE-2026-21860 via werkzeug (0.15.2)

werkzeug PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - discourse-sso-oidc-bridge-consideratio =0.1.8, =0.0.2, =1.0.22, =1.0.28.3 Source cves: CVE-2026-21860 Source advisory: OSV:PYSEC-2026-2044...

flask-autocrud (2.1.0), miscan (1.1.1) potentially affected by CVE-2025-66221 via werkzeug (0.15.0)

werkzeug PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - flask-autocrud 2.1.0 - miscan 1.1.1 Source cves: CVE-2025-66221 Source advisory: OSV:PYSEC-2026-2046...

biuletyn-bip (>=0.6.2, <=0.7.1), dallinger (>=7.4.0, <=8.1.0) +188 more potentially affected by CVE-2025-66221 via werkzeug (2.0.0rc5)

werkzeug PYPI version 2.0.0rc5 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - biuletyn-bip =0.6.2, =7.4.0, =2.1.2, =0.0.3, =0.0.4, =5.6.0, =5.2.0, =5.2.21, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =6.0.5 and more Source...

PYSEC-2026-1399 Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

Summary The Fugue framework implements an RPC server system for distributed computing operations. In the core functionality of the RPC server implementation, I found that the decode function in fugue/rpc/flask.py directly uses cloudpickle.loads to deserialize data without any sanitization. This...

Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

SummaryThe Fugue framework implements an RPC server system for distributed computing operations. In the corefunctionality of the RPC server implementation, Ifound thatthedecodefunction infugue/rpc/flask.pydirectly usescloudpickle.loadsto deserialize datawithout any sanitization. This creates a...

my-flask (2023.4.23), zonesmart-utils (>=0.4.0, <=0.4.1) potentially affected by CVE-2025-8869 via pip (23.0.0)

pip PYPI version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - my-flask 2023.4.23 - zonesmart-utils =0.4.0, =0.4.1 Source cves: CVE-2025-8869 Source advisory: OSV:PYSEC-2026-1795...

doc-tour (>=0.1.2, <=0.1.4) potentially affected by CVE-2025-58065 via flask-appbuilder (2.2.2)

flask-appbuilder PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - doc-tour =0.1.2, =0.1.4 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

ImpactWhen Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create J...

PYSEC-2026-1378 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +134 more potentially affected by CVE-2025-58065 via flask-appbuilder (>=4.1.2, <=4.6.3)

flask-appbuilder PYPI version =4.1.2, =0.9.5.1rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.2.1, =0.4.0, =0.1.0a1, =0.8.2, =0.1.1, =0.1.1, =1.10.6 - airflow-cyberark-secrets-backend 0.1.0 - airflow-dagfactory 0.19.1 and more Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +97 more potentially affected by CVE-2025-58065 via flask-appbuilder (2.3.4)

flask-appbuilder PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.7rc1, =2020.5.20rc1, =2021.2.5rc1,...

apache-airflow-backport-providers-papermill (>=2021.2.5rc1, <=2021.3.3) potentially affected by CVE-2025-58065 via flask-appbuilder (2.2.0)

flask-appbuilder PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow-backport-providers-papermill =2021.2.5rc1, =2021.3.3 Source cves: CVE-2025-58065 Source advisory:...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +16 more potentially affected by CVE-2025-58065 via flask-appbuilder (3.4.5)

flask-appbuilder PYPI version 3.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =2.0.2rc1, =0.0.4rc1, =0.0.0, =0.5.2, =0.8.3a...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2025-58065 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2025-58065 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +6 more potentially affected by CVE-2025-58065 via flask-appbuilder (3.1.1)

flask-appbuilder PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - aglow =0.1.0rc3, =2022.9.19, =2.0.0b1, =1.4.0, =2.0.4 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plug...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2025-58065 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2025-58065 Source advisory:...

apache-airflow (>=2.2.4rc1, <=2.2.5rc2), apilogicserver (>=5.2.15, <=5.3.33) potentially affected by CVE-2025-58065 via flask-appbuilder (3.4.4)

flask-appbuilder PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.2.4rc1, =5.2.15, =5.3.33 Source cves: CVE-2025-58065 Source advisory: OSV:PYSEC-2026-1378...