https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:49:01.056743+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-03T09:49:01.125275+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-220260 EUVD-2026-220260 2026-10-03T09:49:01.125340+00:00 EUVD-2026-220260 https://cve.radiocsirt.org/vuln/fkie_cve-2025-24023 fkie_cve-2025-24023 2026-10-03T09:49:01.125356+00:00

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

 https://cve.radiocsirt.org/vuln/ghsa-p8q5-cvwx-wvwp GHSA-p8q5-cvwx-wvwp — Flask-AppBuilder Observable Response Discrepancy 2026-10-03T09:49:01.125379+00:00

Affected: PyPI: flask-appbuilder

### Impact User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.

### Patches

Upgrade to flask-appbuilder>=4.5.3

### Workarounds Downgrade werkzeug to <3.0.0

### References _Are there any links users can visit to find out more?_

 https://cve.radiocsirt.org/vuln/pysec-2025-15 PYSEC-2025-15 2026-10-03T09:49:01.125405+00:00

Affected: PyPI: flask-appbuilder

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.