appfly (>=0.1.0, <=2.1.0), boyaa-seed (>=0.1.1, <=0.1.6) +6 more potentially affected by CVE-2024-6839 via flask-cors (3.0.6)

flask-cors PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - appfly =0.1.0, =0.1.1, =0.0.8, =1.2.0, =0.1.3, =0.2.10, =0.10.0, =0.100.3 Source cves: CVE-2024-6839 Source advisory: OSV:PYSEC-2026-1384...

allennlp (>=0.8.0, <=0.8.2), lapdog (0.15.4) +15 more potentially affected by CVE-2024-6839 via flask-cors (3.0.7)

flask-cors PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - allennlp =0.8.0, =0.5.1.dev0, =1.1.4, =3.9.6, =0.2.0, =0.1.0, =0.1.0, =0.1.3, =0.3.8, =0.2.3, =1.0.1, =1.4.0.dev26 and more Source cves:...

altair-images (>=0.1.0, <=0.1.4), amundsen-common (>=0.14.0, <=0.15.3) +69 more potentially affected by CVE-2024-6866 via flask-cors (3.0.8)

flask-cors PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - altair-images =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =0.11.0, =0.9.0, =0.1.0, =0.2.2 and more Source cves:...

altair-images (>=0.1.0, <=0.1.4), amundsen-common (>=0.14.0, <=0.15.3) +69 more potentially affected by CVE-2024-6839 via flask-cors (3.0.8)

flask-cors PYPI version 3.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - altair-images =0.1.0, =0.14.0, =3.10.0, =2.4.0, =3.9.0, =2.4.1, =0.1.0.dev1, =0.11.0, =0.9.0, =0.1.0, =0.2.2 and more Source cves:...

actionpi (>=1.1.4, <=1.2.0.dev22), backwardcompatibilityml (>=1.0.0, <=1.4.2) +28 more potentially affected by CVE-2024-6866 via flask-cors (3.0.9)

flask-cors PYPI version 3.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - actionpi =1.1.4, =1.0.0, =0.3.24, =1.4.0rc1, =0.0.1, =3.1.6, =0.1.17, =0.0.17, =0.8.0, =0.1.8.1, =0.1.1, =0.0.12, =0.0.22 and more Source...

ag-llama-api (>=0.0.1, <=0.0.31), ag-llama-api-s (>=0.0.4, <=0.0.12) +298 more potentially affected by CVE-2024-6839 via flask-cors (3.0.10)

flask-cors PYPI version 3.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - ag-llama-api =0.0.1, =0.0.4, =0.0.13, =1.0.2, =2.5.0, =2.5.0, =0.1.0b2696.post0.dev1, =0.1.8, =0.0.1, =1.0.2, =1.0.1, =4.1.0, =3.4.0, =4.0....

astaligner (>=0.1.0, <=1.0.2), cacaodocs (>=0.1.3, <=0.1.14) +30 more potentially affected by CVE-2024-6844 via flask-cors (5.0.0)

flask-cors PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - astaligner =0.1.0, =0.1.3, =0.1.0, =1.0.0a0, =0.1.0, =1.0.0, =1.5.8, =0.1.0, =0.0.10, =3.11.44, =3.3.4, =0.0.1, =0.0.3 and more Source cves:...

agentic-ai-vass-tools (>=0.1.0, <=0.4.0), altspell (>=0.1.0, <=0.4.0) +39 more potentially affected by CVE-2024-6839 via flask-cors (5.0.1)

flask-cors PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-cors and may be impacted: - agentic-ai-vass-tools =0.1.0, =0.1.0, =0.21.0, =1.3.3, =0.2.0, =4.21.0b8, =1.7.0, =0.2.4, =0.1.0, =0.1.1, =3.13.7, =3.16.1 and more Source...

Flask-CORS improper regex path matching vulnerability

corydolphin/flask-cors version 5.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...

pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

PYSEC-2026-1842 pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery CSRF via the Flask endpoints...

bentodev (>=0.1.17, <=2018.11.2), biweeklybudget (>=0.1.0, <=0.7.0) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.12.1)

werkzeug PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - bentodev =0.1.17, =0.1.0, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2024-49766 Source advisory: OSV:PYSEC-2026-2045...

flask-autocrud (2.1.0), miscan (1.1.1) potentially affected by CVE-2024-49766 via werkzeug (0.15.0)

werkzeug PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - flask-autocrud 2.1.0 - miscan 1.1.1 Source cves: CVE-2024-49766 Source advisory: OSV:PYSEC-2026-2045...

celery-director (>=0.5.0, <=0.7.0), elementary-flask (>=0.0.1.dev7, <=0.0.1.dev12) +11 more potentially affected by CVE-2024-49766 via werkzeug (2.1.1)

werkzeug PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - celery-director =0.5.0, =0.0.1.dev7, =0.0.1, =1.0.0, =1.3.0, =0.7.0b10, =1.1.2, =1.1.8 Source cves: CVE-2024-49766 Source advisory:...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2024-49766 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2024-49766 Source advisory:...

apache-airflow (>=2.2.4rc1, <=2.2.5rc2), apilogicserver (>=5.2.15, <=5.3.33) potentially affected by CVE-2024-45314 via flask-appbuilder (3.4.4)

flask-appbuilder PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.2.4rc1, =5.2.15, =5.3.33 Source cves: CVE-2024-45314 Source advisory: OSV:PYSEC-2026-1382...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +16 more potentially affected by CVE-2024-45314 via flask-appbuilder (3.4.5)

flask-appbuilder PYPI version 3.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =2.0.2rc1, =0.0.4rc1, =0.0.0, =0.5.2, =0.8.3a...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2024-45314 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2024-45314 Source advisory: OSV:PYSEC-2026-1382...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2024-45314 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2024-45314 Source advisory:...

doc-tour (>=0.1.2, <=0.1.4) potentially affected by CVE-2024-45314 via flask-appbuilder (2.2.2)

flask-appbuilder PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - doc-tour =0.1.2, =0.1.4 Source cves: CVE-2024-45314 Source advisory: OSV:PYSEC-2026-1382...