Flask vulnerabilities and fixes

CVEs that mention Flask, ranked by priority. 7 tracked.

Flask has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-10-23. Highest priority: CVE-2026-72577 (score 60/100).

• CVE-2026-72577 CRITICAL 9.8 Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve
• CVE-2026-35052 CRITICAL 9.8 UPGRADE D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures
• CVE-2026-115727 HIGH 8.1 AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py har
• CVE-2026-71241 HIGH 7.5 Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_b
• CVE-2026-75529 MEDIUM 6.9 Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality
• CVE-2026-48508 HIGH 8.8 Lemur manages TLS certificate creation
• CVE-2026-17350 MEDIUM 5.4 UPGRADE The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did n

FAQ

How do I fix Flask vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Flask being exploited right now?

None of the tracked Flask CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Flask CVE should I patch first?

CVE-2026-72577 currently ranks highest (60/100): Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve .

← Back to latest CVEs