LOWPyPI
GHSA-4grg-w6v8-c28g· CVE-2025-47278, PYSEC-2026-1377Flask uses fallback key instead of current signing key
Modified: 9/10/2026
package
PyPI/flask
pkg:pypi/flask
HIGH7.5PyPI
GHSA-562c-5r94-xh97· CVE-2018-1000656, PYSEC-2018-66Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
Modified: 2/21/2025
HIGH7.5PyPI
GHSA-5wv5-4vpf-pj6m· CVE-2019-1010083, PYSEC-2019-179Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage
Modified: 9/20/2024
LOWPyPI
GHSA-68rp-wp8r-4726· CVE-2026-27205, PYSEC-2026-2151Flask session does not add `Vary: Cookie` header when accessed in some ways
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-m2qf-hxjv-5gpq· CVE-2023-30861, PYSEC-2023-62Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
Modified: 9/10/2026
—PyPI
PYSEC-2018-66· CVE-2018-1000656, GHSA-562c-5r94-xh97Modified: 11/8/2023
—PyPI
PYSEC-2019-179· CVE-2019-1010083, GHSA-5wv5-4vpf-pj6mModified: 11/8/2023
—PyPI
PYSEC-2023-62· CVE-2023-30861, GHSA-m2qf-hxjv-5gpqModified: 11/8/2023
—PyPI
PYSEC-2026-1377· CVE-2025-47278, GHSA-4grg-w6v8-c28gFlask uses fallback key instead of current signing key
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-2151· CVE-2026-27205, GHSA-68rp-wp8r-4726Modified: 7/13/2026