# cve.now: Flask

The newest entries affecting Flask (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-54567](https://cve.now/CVE-2026-54567.md): Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) (CVSS 7.5, jugmac00 flask-reuploaded · flask-reuploaded)
- [CVE-2026-46715](https://cve.now/CVE-2026-46715.md): Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance (CVSS 5.3, pallets-eco Flask-Security-Too · flask-security-too)
- [CVE-2026-15034](https://cve.now/CVE-2026-15034.md): flask-dashboard Flask-MonitoringDashboard cross-site request forgery (CVSS 5.3, flask-dashboard Flask-MonitoringDashboard)
- [CVE-2026-34531](https://cve.now/CVE-2026-34531.md): Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client (CVSS 6.5, miguelgrinberg Flask-HTTPAuth · flask-httpauth)
- [CVE-2026-27641](https://cve.now/CVE-2026-27641.md): Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection (CVSS 9.8, jugmac00 flask-reuploaded · flask-reuploaded)
- [CVE-2026-27205](https://cve.now/CVE-2026-27205.md): Flask session does not add \`Vary: Cookie\` header when accessed in some ways (CVSS 2.3, pallets flask · flask)
- [CVE-2025-58065](https://cve.now/CVE-2025-58065.md): Flask App Builder has an Authentication Bypass vulnerability when using non AUTH\_DB methods (CVSS 6.5, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2025-32962](https://cve.now/CVE-2025-32962.md): Flask-AppBuilder open redirect vulnerability using HTTP host injection (CVSS 4.3, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2025-47278](https://cve.now/CVE-2025-47278.md): Flask uses fallback key instead of current signing key (CVSS 1.8, pallets flask · flask)
- [CVE-2025-24023](https://cve.now/CVE-2025-24023.md): Observable Response Discrepancy in flask-appbuilder (CVSS 3.7, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2024-45314](https://cve.now/CVE-2024-45314.md): Flask-AppBuilder login form allows browser to cache sensitive fields (CVSS 3.6, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2024-27083](https://cve.now/CVE-2024-27083.md): Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS) (CVSS 4.3, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2024-25128](https://cve.now/CVE-2024-25128.md): Flask-AppBuilder incorrect authentication when using auth type OpenID (CVSS 9.1, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2023-34110](https://cve.now/CVE-2023-34110.md): Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error (CVSS 2.7, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2023-30861](https://cve.now/CVE-2023-30861.md): Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header (CVSS 7.5, pallets flask · flask)
- [CVE-2023-29005](https://cve.now/CVE-2023-29005.md): No Rate Limiting on Login AUTH DB (CVSS 7.5, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2021-23385](https://cve.now/CVE-2021-23385.md): Open Redirect (CVSS 5.4, Flask-Security)
- [CVE-2022-31177](https://cve.now/CVE-2022-31177.md): Possible to infer sensitive information through query strings in Flask-AppBuilder (CVSS 2.7, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2022-24880](https://cve.now/CVE-2022-24880.md): Potential Captcha Validate Bypass in flask-session-captcha (CVSS 5.3, Tethik flask-session-captcha · flask-session-captcha)
- [CVE-2022-24776](https://cve.now/CVE-2022-24776.md): Open Redirect in Flask-AppBuilder (CVSS 6.1, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2021-41265](https://cve.now/CVE-2021-41265.md): Improper Authentication in Flask-AppBuilder (CVSS 8.1, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2021-32838](https://cve.now/CVE-2021-32838.md): Regular Expression Denial of Service in flask-restx (CVSS 7.5, python-restx flask-restx · flask-restx)
- [CVE-2021-32805](https://cve.now/CVE-2021-32805.md): URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder (CVSS 7.2, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2021-23401](https://cve.now/CVE-2021-23401.md): Open Redirect (CVSS 5.4, Flask-User)
- [CVE-2021-23393](https://cve.now/CVE-2021-23393.md): Open Redirect (CVSS 5.4, Flask-Unchained)
- [CVE-2021-29621](https://cve.now/CVE-2021-29621.md): Observable Response Discrepancy in Flask-AppBuilder (CVSS 5.3, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2021-32618](https://cve.now/CVE-2021-32618.md): Open Redirect Vulnerability (CVSS 3.1, Flask-Middleware flask-security · flask-security-too)
- [CVE-2021-21241](https://cve.now/CVE-2021-21241.md): CSRF can expose users authentication token in Flask-Security-Too (CVSS 7.4, Flask-Middleware flask-security-too · flask-security-too)
- [CVE-2019-1010083](https://cve.now/CVE-2019-1010083.md): The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. (no CVSS, The Pallets Project Flask · flask)
- [CVE-2018-1000656](https://cve.now/CVE-2018-1000656.md): The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large (no CVSS, flask)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/flask
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.