https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:20:48.058303+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-210118 EUVD-2026-210118 2026-10-03T05:20:48.061509+00:00 EUVD-2026-210118 https://cve.radiocsirt.org/vuln/fkie_cve-2023-33175 fkie_cve-2023-33175 2026-10-03T05:20:48.061539+00:00

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

 https://cve.radiocsirt.org/vuln/ghsa-hh7j-pg39-q563 GHSA-hh7j-pg39-q563 — toui allows user-specific variables to be shared between users 2026-10-03T05:20:48.061570+00:00

Affected: PyPI: toui

### Impact Websites that use `Website.user_vars` property in versions.

### Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

### Workarounds Do not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only.

### Explanation ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.

 https://cve.radiocsirt.org/vuln/gsd-2023-33175 gsd-2023-33175 2026-10-03T05:20:48.061599+00:00 gsd-2023-33175 https://cve.radiocsirt.org/vuln/pysec-2026-555 PYSEC-2026-555 — toui allows user-specific variables to be shared between users 2026-10-03T05:20:48.061612+00:00

Affected: PyPI: toui

### Impact Websites that use `Website.user_vars` property in versions. ### Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

### Workarounds Do not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only. ### Explanation ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.