CVE-2026-6977

CVE-2026-6977 affects vanna-ai vanna up to 2.0.2, arising from an unknown function in the Legacy Flask API that leads to improper authorization. The vulnerability is exploitable remotely and has been disclosed publicly; exploitation status is indicated as a public disclosure with potential use. T...

SafeVault

SafeVault - Security and Authentication Capstone Project A pr...

[SECURITY] Fedora 44 Update: python-flask-httpauth-4.8.1-1.fc44

FlaskHTTPAuth Basic and Digest HTTP authentication for Flask routes...

Vanna security vulnerabilities

Vanna is a personalized AI SQL proxy from Vanna Corporation. Versions of Vanna 2.0.2 and earlier contained security vulnerabilities, which were caused by improper authorization in the Legacy Flask API component. These vulnerabilities could lead to remote attacks...

PT-2026-35147

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and ma...

CVE-2026-6977: Improper Authorization

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and ma...

bioc (>=1.2.0, <=1.2.2), cro-tax-debtors (>=0.2.1, <=0.5.1) +19 more potentially affected by CVE-2026-41066 via lxml (4.2.1)

lxml PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.2.0, =0.2.1, =1.0.0, =0.0.2, =1.0.0, =2.0.0.0a0, =0.2.2, =0.0.1a0, =0.0.1, =0.2.7, =1.6.3, =0.8.0.0, =0.9.0.7 and more Source cves: CVE-2026-410...

📄 Keras 3.13.0 Malicious ML Model Server HDF5 Shape Bomb

This script is a Flask-based web server that distributes .keras machine learning model files, but it is designed in a malicious way for security research/testing scenarios. The main idea is a denial of service via memory exhaustion, where generated Keras models contain artificially declared...

bioc (>=1.2.0, <=1.2.2), cro-tax-debtors (>=0.2.1, <=0.5.1) +19 more potentially affected by CVE-2026-41066 via lxml (4.2.1)

lxml PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.2.0, =0.2.1, =1.0.0, =0.0.2, =1.0.0, =2.0.0.0a0, =0.2.2, =0.0.1a0, =0.0.1, =0.2.7, =1.6.3, =0.8.0.0, =0.9.0.7 and more Source cves: CVE-2026-410...

PYSEC-2026-125

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the setsessioncookiesecure beforerequest handler in src/pyload/webui/app/init.py reads the X-Forwarded-Proto header from any HTTP request without validating that the request originates from a trusted prox...

lantern-flask (>=0.0.24, <=0.0.47), tgbotgen (>=0.1.0, <=0.2.1) potentially affected by CVE-2026-28684 via python-dotenv (0.9.0)

python-dotenv PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - lantern-flask =0.0.24, =0.1.0, =0.2.1 Source cves: CVE-2026-28684 Source advisory: OSV:GHSA-MF9W-MJ56-HR94...

my-flask (2023.4.23), zonesmart-utils (>=0.4.0, <=0.4.1) potentially affected by CVE-2026-3219 via pip (23.0.0)

pip PYPI version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - my-flask 2023.4.23 - zonesmart-utils =0.4.0, =0.4.1 Source cves: CVE-2026-3219 Source advisory: OSV:GHSA-58QW-9MGM-455V...

lantern-flask (>=0.0.24, <=0.0.47), tgbotgen (>=0.1.0, <=0.2.1) potentially affected by CVE-2026-28684 via python-dotenv (0.9.0)

python-dotenv PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - lantern-flask =0.0.24, =0.1.0, =0.2.1 Source cves: CVE-2026-28684 Source advisory: OSV:PYSEC-2026-2270...

Exploit for Improper Input Validation in Python

CVE-2023-24329 — Parser Differential Lab Educational use...

Flask Debug Mode detection

Detects if Flask debug mode Werkzeug is enabled on the target, which may lead to RCE. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Flask Debug Mode detection', 'description':...

[SECURITY] Fedora 43 Update: python-flask-httpauth-4.8.1-1.fc43

FlaskHTTPAuth Basic and Digest HTTP authentication for Flask routes...

Fedora: Security Advisory (FEDORA-2026-04d6f223e0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 43 : python-flask-httpauth (2026-04d6f223e0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-04d6f223e0 advisory. Update to version 4.8.1 2454342 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Vulnerable-Web-App-Scanner

Vulnerable-Web-App-Scanner Pent...

OPENSUSE-SU-2026:20576-1 Security update for python-Flask-HTTPAuth

This update for python-Flask-HTTPAuth fixes the following issues: Changes in python-Flask-HTTPAuth: - CVE-2026-34531: Do not accept empty tokens bsc1261355...