PyPI Package Vulnerabilities
Vulnerabilities associated with flask-appbuilder.
Packages
Clear package- tensorflow433 vulnerabilities
- tensorflow-gpu427 vulnerabilities
- tensorflow-cpu423 vulnerabilities
- Django147 vulnerabilities
- open-webui133 vulnerabilities
- apache-airflow129 vulnerabilities
- Plone96 vulnerabilities
- mlflow79 vulnerabilities
- apache-superset67 vulnerabilities
- salt67 vulnerabilities
- ansible66 vulnerabilities
- pillow61 vulnerabilities
- picklescan59 vulnerabilities
- vllm59 vulnerabilities
- gradio49 vulnerabilities
- nova49 vulnerabilities
- aiohttp48 vulnerabilities
- pyload-ng48 vulnerabilities
- matrix-synapse45 vulnerabilities
- vyper44 vulnerabilities
- rdiffweb43 vulnerabilities
- praisonai40 vulnerabilities
- keystone39 vulnerabilities
- pypdf39 vulnerabilities
- PraisonAI37 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-58065MEDIUM | Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methodsFlask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.… CWE-287Sep 11, 2025 | CVSS6.5v3.1 | EPSS0.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-32962MEDIUM | Flask-AppBuilder open redirect vulnerability using HTTP host injectionFlask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers. CWE-601May 16, 2025 | CVSS4.3v3.1 | EPSS0.203% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Observable Response Discrepancy in flask-appbuilderFlask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3. | CVSS3.7v3.1 | EPSS0.317% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Flask-AppBuilder login form allows browser to cache sensitive fieldsFlask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory. CWE-525Sep 4, 2024 | CVSS-v4.0 | EPSS0.262% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |