Flask vulnerabilities
The newest vulnerabilities affecting Flask, up to 200. Subscribe by RSS.
- CVE-2026-54567Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)jugmac00 flask-reuploaded · flask-reuploaded
- CVE-2026-46715Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptancepallets-eco Flask-Security-Too · flask-security-too
- CVE-2026-15034flask-dashboard Flask-MonitoringDashboard cross-site request forgeryflask-dashboard Flask-MonitoringDashboard
- CVE-2026-34531Flask-HTTPAuth invokes token verification callback when missing or empty token was given by clientmiguelgrinberg Flask-HTTPAuth · flask-httpauth
- CVE-2026-27641Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injectionjugmac00 flask-reuploaded · flask-reuploaded
- CVE-2026-27205Flask session does not add `Vary: Cookie` header when accessed in some wayspallets flask · flask
- CVE-2025-58065Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methodsdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2025-32962Flask-AppBuilder open redirect vulnerability using HTTP host injectiondpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2025-47278Flask uses fallback key instead of current signing keypallets flask · flask
- CVE-2025-24023Observable Response Discrepancy in flask-appbuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2024-45314Flask-AppBuilder login form allows browser to cache sensitive fieldsdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2024-27083Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)dpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2024-25128Flask-AppBuilder incorrect authentication when using auth type OpenID dpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2023-34110Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user errordpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2023-30861Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie headerpallets flask · flask
- CVE-2023-29005No Rate Limiting on Login AUTH DBdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2021-23385Open RedirectFlask-Security
- CVE-2022-31177Possible to infer sensitive information through query strings in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2022-24880Potential Captcha Validate Bypass in flask-session-captchaTethik flask-session-captcha · flask-session-captcha
- CVE-2022-24776Open Redirect in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2021-41265Improper Authentication in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2021-32838Regular Expression Denial of Service in flask-restxpython-restx flask-restx · flask-restx
- CVE-2021-32805URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2021-23401Open RedirectFlask-User
- CVE-2021-23393Open RedirectFlask-Unchained
- CVE-2021-29621Observable Response Discrepancy in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2021-32618Open Redirect VulnerabilityFlask-Middleware flask-security · flask-security-too
- CVE-2021-21241CSRF can expose users authentication token in Flask-Security-TooFlask-Middleware flask-security-too · flask-security-too
- CVE-2019-1010083The Pallets Project Flask before 1.0 is affected by: unexpected memory usage.The Pallets Project Flask · flask
- CVE-2018-1000656The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Largeflask