abstra (>=1.8.8, <=2.5.1), adeso (>=0.0.1, <=0.0.4) +70 more potentially affected by CVE-2024-6839 via flask-cors (4.0.0)

flask-cors PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - abstra =1.8.8, =0.0.1, =0.0.1, =0.0.6.dev1, =0.1.2, =0.0.7, =0.2.18, =0.1.0, =51.9.7, =0.0.25, =0.0.10, =0.0.12 and more Source cves:...

allennlp (>=0.4.0, <=0.4.1), cli-pipeline (>=1.5.102, <=1.5.105) +9 more potentially affected by CVE-2024-6839 via flask-cors (3.0.3)

flask-cors PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - allennlp =0.4.0, =1.5.102, =0.1.1, =0.0.5.1, =0.6.0, =0.50.0, =0.0.0.1, =1.0.2, =1.0.4 - teshu 0.0.2 Source cves: CVE-2024-6839 Source...

comet-common (>=1.0.5, <=2.0.3), comet-core (>=1.0.4, <=2.0.1) +5 more potentially affected by CVE-2024-6839 via flask-cors (3.0.4)

flask-cors PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - comet-common =1.0.5, =1.0.4, =0.4.4a3, =0.0.24, =0.4.0, =0.4.4a3, =0.4.4 Source cves: CVE-2024-6839 Source advisory: OSV:PYSEC-2026-1384...

apilogicserver (>=1.4.0, <=5.3.33) potentially affected by CVE-2024-6866 via flask-cors (3.0.0)

flask-cors PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - apilogicserver =1.4.0, =5.3.33 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

feather (>=0.0.6, <=0.0.8) potentially affected by CVE-2024-6866 via flask-cors (1.1.2)

flask-cors PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - feather =0.0.6, =0.0.8 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...

wikilabels (>=0.3.1, <=0.4.0) potentially affected by CVE-2024-6866 via flask-cors (2.1.3)

flask-cors PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - wikilabels =0.3.1, =0.4.0 Source cves: CVE-2024-6866 Source advisory: OSV:PYSEC-2026-1383...

ag-llama-api (>=0.0.1, <=0.0.31), ag-llama-api-s (>=0.0.4, <=0.0.12) +298 more potentially affected by CVE-2024-6866 via flask-cors (3.0.10)

flask-cors PYPI version 3.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - ag-llama-api =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =1.0.1, =4.1.0, =3.4.0, =4.0....

kozmo-core (0.1.0), scanflow (>=0.1.0, <=0.1.1) +1 more potentially affected by CVE-2024-6839 via flask-cors (4.0.0a0)

flask-cors PYPI version 4.0.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - kozmo-core 0.1.0 - scanflow =0.1.0, =0.5.0.3, =1.18.2 Source cves: CVE-2024-6839 Source advisory: OSV:PYSEC-2026-1384...

agentic-ai-vass-tools (>=0.1.0, <=0.4.0), altspell (>=0.1.0, <=0.4.0) +39 more potentially affected by CVE-2024-6839 via flask-cors (5.0.1)

flask-cors PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - agentic-ai-vass-tools =0.1.0, =0.1.0, =0.21.0, =1.3.3, =0.2.0, =4.21.0b8, =1.7.0, =0.2.4, =0.1.0, =0.1.1, =3.13.7, =3.16.1 and more Source...

pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

PYSEC-2026-1842 pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

bentodev (>=0.1.17, <=2018.11.2), biweeklybudget (>=0.1.0, <=0.7.0) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.12.1)

werkzeug PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - bentodev =0.1.17, =0.1.0, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2024-49766 Source advisory: OSV:PYSEC-2026-2045...

celery-director (>=0.5.0, <=0.7.0), elementary-flask (>=0.0.1.dev7, <=0.0.1.dev12) +11 more potentially affected by CVE-2024-49766 via werkzeug (2.1.1)

werkzeug PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - celery-director =0.5.0, =0.0.1.dev7, =0.0.1, =1.0.0, =1.3.0, =0.7.0b10, =1.1.2, =1.1.8 Source cves: CVE-2024-49766 Source advisory:...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-49766 Source advisory:...

flask-autocrud (2.1.0), miscan (1.1.1) potentially affected by CVE-2024-49766 via werkzeug (0.15.0)

werkzeug PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - flask-autocrud 2.1.0 - miscan 1.1.1 Source cves: CVE-2024-49766 Source advisory: OSV:PYSEC-2026-2045...

abi-ds-utils (1.0.1), acryl-datahub-airflow-plugin (>=0.10.5.2rc3, <=0.11.0) +31 more potentially affected by CVE-2024-45314 via flask-appbuilder (>=4.1.2, <=4.5.0)

flask-appbuilder PYPI version =4.1.2, =0.10.5.2rc3, =0.2.1, =0.8.2, =0.3.1, =0.0.4, =0.0.1a0, =2.3.3rc1, =1.0.0rc1, =1.0.0rc1, =1.0.2.dev1, =1.0.0rc1, =1.0.0b2, =2.5.1 and more Source cves: CVE-2024-45314 Source advisory: OSV:PYSEC-2026-1382...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2024-45314 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2024-45314 Source advisory: OSV:PYSEC-2026-1382...

Flask-AppBuilder's login form allows browser to cache sensitive fields

ImpactAuth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. PatchesUpgrade flask-appbuilder to version 4.5.1 WorkaroundsIf upgrading is not possible configure your web server to send the...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2024-45314 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....