https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-58065.htmlhttps://patchthecve.com/cve/CVE-2025-58065.htmlWed, 17 Jun 2026 09:43:51 +0000MEDIUM 6.5: Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. Thhttps://patchthecve.com/cve/CVE-2025-32962.htmlhttps://patchthecve.com/cve/CVE-2025-32962.htmlWed, 17 Jun 2026 09:12:52 +0000MEDIUM 4.3: Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` confhttps://patchthecve.com/cve/CVE-2025-24023.htmlhttps://patchthecve.com/cve/CVE-2025-24023.htmlWed, 17 Jun 2026 08:57:54 +0000LOW 3.7: Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.https://patchthecve.com/cve/CVE-2024-45314.htmlhttps://patchthecve.com/cve/CVE-2024-45314.htmlWed, 17 Jun 2026 07:54:00 +0000LOW 3.6: Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If up