4068 matches found
Security update for python-Flask
This update for python-Flask fixes the following issue: CVE-2026-27205: information disclosure due to Flask session not adding the Vary: Cookie header bsc1258700. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:0849-1 Security update for python-Flask
This update for python-Flask fixes the following issue: - CVE-2026-27205: information disclosure due to Flask session not adding the Vary: Cookie header bsc1258700...
flask_ssti_exploit
Tools for Exploiting SSTI Vulnerabilities under Flask Di...
flask_ssti_exploit
Tools for Exploiting SSTI Vulnerabilities under Flask Di...
CVE-2026-29038: Improper Neutralization of Input During Web Page Generation
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting XSS vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The taguuid path parameter is reflected directly in the HTTP response body...
Symfony-RCE
Symfony-RCE Exploit for the Symfony fragment Remote Code E...
GHSA-8WHX-V8QQ-PQ64 changedetection.io has Reflected XSS in its RSS Tag Error Response
A reflected cross-site scripting XSS vulnerability was identified in the /rss/tag/ endpoint of changedetection.io. The taguuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser...
Hackviser
Hackviser — Scenario Writeups A collection of detailed writeu...
hckr-tr
⠀⠀⠀⣠⣴⡶⢶⣦⣄⠀⠀⠀⠀⠀⠀⠀⠀⣾⠋⠙⢿⣆⣤⣤⣄⠀⠀⠀ ⠀⠀⢰⣿⠁⠀⠀⠀⠙⢷⡄⠀⠀⠀⠀⠀⢸⡿⠀⠀⠀⠛⠉...
Sensitive Information Exposure
Flask is vulnerable to Sensitive Information Exposure. The vulnerability is due to incomplete handling of the Vary: Cookie header when accessing the session object, where certain access patterns e.g., using the in operator fail to mark responses as user-specific, allowing caching proxies to store...
CVE-2026-28352: Missing Authentication for Critical Function
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this ...
python311-Flask-3.1.3-1.1 on GA media (moderate)
python311-Flask-3.1.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:10264-1 Rating: moderate Cross-References: CVE-2026-27205 CVSS scores: CVE-2026-27205 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2026-27205 SUSE : 6...
CVE-2026-27641
Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection SSTI. Flask-Reuploaded has been patche...
OPENSUSE-SU-2026:10264-1 python311-Flask-3.1.3-1.1 on GA media
These are all security issues fixed in the python311-Flask-3.1.3-1.1 package on the GA media of openSUSE Tumbleweed...
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
Summary Three security vulnerabilities were identified in changedetection.io through source code review and live validation against a locally deployed Docker instance. All vulnerabilities were confirmed exploitable on the latest version 0.53.6 it was additionally validated at scale against 500...
coati-payroll (>=1.0.1, <=1.10.0), now-lms (>=1.0.3, <=1.2.3) +1 more potentially affected by CVE-2026-27641 via flask-reuploaded (>=1.2.0, <=1.4.0)
flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-27641 Source advisory: GHSA-65MP-FQ8V-56JR...
coati-payroll (>=1.0.1, <=1.10.0), now-lms (>=1.0.3, <=1.2.3) +1 more potentially affected by CVE-2026-27641 via flask-reuploaded (>=1.2.0, <=1.4.0)
flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.1.0 Source cves: CVE-2026-27641 Source advisory: OSV:GHSA-65MP-FQ8V-56JR...
GHSA-65MP-FQ8V-56JR Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
Impact A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection SSTI. Patches Flask-Reuploaded has been patched in version 1.5.0 Workarounds 1. Do not...
Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
Impact A critical path traversal and extension bypass vulnerability in Flask-Reuploaded allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Template Injection SSTI. Patches Flask-Reuploaded has been patched in version 1.5.0 Workarounds 1. Do not...
