https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:58:57 +0000 https://cve.radiocsirt.org/vuln/cve-2025-32962 <p><strong>Affected:</strong> dpgaspar Flask-AppBuilder</p> <p>Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.</p> <p><strong>Affected:</strong> dpgaspar Flask-AppBuilder</p> <p>Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_REDIRECT_HOSTS` configuration variable, which allows administrators to explicitly define which domains are considered safe for redirection. As a workaround, use a reverse proxy to enforce trusted host headers.</p> https://cve.radiocsirt.org/vuln/cve-2025-32962 https://cve.radiocsirt.org/vuln/ghsa-78cv-mqj4-43f7 <p><strong>Affected:</strong> PyPI: tornado</p> <p>Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.</p> <p><strong>Affected:</strong> PyPI: tornado</p> <p>Values passed to the `domain`, `path`, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior to 6.5.5. In particular, semicolons would be allowed, which could be used to inject attacker-controlled values for other cookie attributes.</p> https://cve.radiocsirt.org/vuln/ghsa-78cv-mqj4-43f7