https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T17:12:54.333891+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-03T17:12:54.416914+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-252539 EUVD-2026-252539 2026-10-03T17:12:54.416980+00:00 EUVD-2026-252539 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58065 fkie_cve-2025-58065 2026-10-03T17:12:54.416996+00:00

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a fix. If immediate upgrade is not possible, manually disable password reset routes in the application configuration; implement additional access controls at the web server or proxy level to block access to the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.

 https://cve.radiocsirt.org/vuln/ghsa-765j-9r45-w2q2 GHSA-765j-9r45-w2q2 — Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods 2026-10-03T17:12:54.417023+00:00

Affected: PyPI: flask-appbuilder

### Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider.

### Patches Upgrade to Flask-AppBuilder version 4.8.1 or later

### Workarounds If immediate upgrade is not possible: - Manually disable password reset routes in the application configuration - Implement additional access controls at the web server or proxy level to block access to the reset my password URL. - Monitor for suspicious password reset attempts from disabled accounts

 https://cve.radiocsirt.org/vuln/pysec-2026-1378 PYSEC-2026-1378 — Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods 2026-10-03T17:12:54.417048+00:00

Affected: PyPI: flask-appbuilder

### Impact When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT tokens even after the user is disabled on the authentication provider.

### Patches Upgrade to Flask-AppBuilder version 4.8.1 or later

### Workarounds If immediate upgrade is not possible: - Manually disable password reset routes in the application configuration - Implement additional access controls at the web server or proxy level to block access to the reset my password URL. - Monitor for suspicious password reset attempts from disabled accounts