CVE-2022-30034

Flower, the web UI for the Celery Python RPC framework, is affected by CVE-2022-30034 via an OAuth authentication bypass. All versions as of 2022-05-02 are vulnerable, potentially allowing an attacker to access the Flower API, discover and invoke arbitrary Celery RPC calls, or cause a denial of s...

CVE-2019-16925

CVE-2019-16925 affects Flower 0.9.3, with an XSS vulnerability reported via the name parameter in an @app.task call. The core issue appears to be unvalidated client-side data in the Flower web interface, but multiple sources note the project author disputes the vulnerability’s validity and emphas...

CVE-2019-16926

Flower version 0.9.3 is described as having a client-side XSS via a crafted worker name (CVE-2019-16926). The affected software is Flower, a web-based Celery monitor, with the vulnerability attributed to internal backend configuration options for worker and task names, which are not user-facing. ...