pallets/flask Security Advisories | GitStock

low2026-02-19

Flask session does not add `Vary: Cookie` header when accessed in some ways

GHSA-68rp-wp8r-4726 · CVE-2026-27205

low2025-05-13

Flask uses fallback key instead of current signing key

GHSA-4grg-w6v8-c28g · CVE-2025-47278

high2023-05-01

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

GHSA-m2qf-hxjv-5gpq · CVE-2023-30861