UBUNTU-CVE-2026-27205

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

celery-director (>=0.5.0, <=0.7.0), elementary-flask (>=0.0.1.dev7, <=0.0.1.dev12) +11 more potentially affected by CVE-2026-27199 via werkzeug (2.1.1)

werkzeug PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - celery-director =0.5.0, =0.0.1.dev7, =0.0.1, =1.0.0, =1.3.0, =0.7.0b10, =1.1.2, =1.1.8 Source cves: CVE-2026-27199 Source advisory:...

bentodev (>=0.1.17, <=2018.11.2), biweeklybudget (>=0.1.0, <=0.7.0) +4 more potentially affected by CVE-2026-27199 via werkzeug (0.12.1)

werkzeug PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - bentodev =0.1.17, =0.1.0, =0.1.48, =0.1.0, =0.2.5 - spiderkeeper-zam 1.2.2 Source cves: CVE-2026-27199 Source advisory: OSV:PYSEC-2026-2320...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2026-27199 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2026-27199 Source advisory:...

PYSEC-2026-2151

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

agent-manager-sdk (>=0.1.1, <=0.1.2), aipack (>=0.0.1, <=0.0.5) +71 more potentially affected by CVE-2026-27205 via flask (2.0.1)

flask PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - agent-manager-sdk =0.1.1, =0.0.1, =0.16.0, =2.3.0, =0.17.0, =0.16.0, =0.11.0, =0.13.0, =0.14.0, =0.15.0 and more Source cves: CVE-2026-27205 Source...

actionpi (>=1.1.4, <=1.2.0.dev22), activedirectoryenum (0.5.0) +287 more potentially affected by CVE-2026-27205 via flask (1.1.2)

flask PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - actionpi =1.1.4, =2.5.0, =2.5.0, =0.0.6, =0.6.2, =0.1.1, =0.7.0, =2021.2.5rc1, =0.1.0.dev1, =1.4.0, =5.3.33 and more Source cves: CVE-2026-27205 Sourc...

notlar (>=0.2.0, <=0.10.0) potentially affected by CVE-2026-27205 via flask (2.3.0)

flask PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask and may be impacted: - notlar =0.2.0, =0.10.0 Source cves: CVE-2026-27205 Source advisory: OSV:PYSEC-2026-2151...

CVE-2026-27205 Flask session does not add `Vary: Cookie` header when accessed in some ways

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

CVE-2026-27205 Flask session does not add `Vary: Cookie` header when accessed in some ways

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

CVE-2026-27205

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

CVE-2026-27205

CVE-2026-27205 – Flask cache-related information disclosure (root cause: Vary: Cookie not set when session accessed) Affected: Flask 3.1.2 and below. In these versions, accessing the session object may cause a response to be cached with user-specific data, as the Vary: Cookie header is not consis...

CVE-2026-27205

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

2m (1.2.5), a-api-server (1.3.0) +3846 more potentially affected by CVE-2026-27205 via flask (>=0.5.0, <=3.1.2)

flask PYPI version =0.5.0, =0.1.0, =0.10.0, =1.0.2, =1.0.0, =1.0.5, =1.8.26, =1.0.2, =0.3.1, =0.3.7.dev2 and more Source cves: CVE-2026-27205 Source advisory: MEND:CVE-2026-27205...

CVE-2026-27205 Flask session does not add `Vary: Cookie` header when accessed in some ways

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

CVE-2026-27205

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

Linux Distros Unpatched Vulnerability : CVE-2026-27205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the...

Flask security vulnerability

Flask is a Python micro-framework developed by Pallets, used for building web applications. Versions of Flask prior to 3.1.2 have a security vulnerability caused by an improper setting of the Vary header when accessing session objects. This vulnerability may lead to the use of cache containing...

CVE-2026-27205: Use of Cache Containing Sensitive Information

Flask is a web server gateway interface WSGI web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the session object. An attacker can cause sensitive user-specific responses to be cached and served to other users by leveraging a caching proxy that does not ignore responses with cookie...