https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:41:05 +0000 https://vulnerability.circl.lu/vuln/cve-2024-6844 <p><strong>Affected:</strong> corydolphin/flask-cors</p> <p>A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the &#39;+&#39; character in URL paths. The request.path is passed through the unquote_plus function, which converts the &#39;+&#39; character to a space &#39; &#39;. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.</p> <p><strong>Affected:</strong> corydolphin/flask-cors</p> <p>A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the &#39;+&#39; character in URL paths. The request.path is passed through the unquote_plus function, which converts the &#39;+&#39; character to a space &#39; &#39;. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.</p> https://vulnerability.circl.lu/vuln/cve-2024-6844 https://vulnerability.circl.lu/vuln/ghsa-8vgw-p6qm-5gr7 <p><strong>Affected:</strong> PyPI: flask-cors</p> <p>A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the &#39;+&#39; character in URL paths. The request.path is passed through the unquote_plus function, which converts the &#39;+&#39; character to a space &#39; &#39;. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.</p> <p><strong>Affected:</strong> PyPI: flask-cors</p> <p>A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the &#39;+&#39; character in URL paths. The request.path is passed through the unquote_plus function, which converts the &#39;+&#39; character to a space &#39; &#39;. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.</p> https://vulnerability.circl.lu/vuln/ghsa-8vgw-p6qm-5gr7 https://vulnerability.circl.lu/vuln/pysec-2026-1385 <p><strong>Affected:</strong> PyPI: flask-cors</p> <p>A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the &#39;+&#39; character in URL paths. The request.path is passed through the unquote_plus function, which converts the &#39;+&#39; character to a space &#39; &#39;. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.</p> <p><strong>Affected:</strong> PyPI: flask-cors</p> <p>A vulnerability in corydolphin/flask-cors version 5.0.1 allows for inconsistent CORS matching due to the handling of the &#39;+&#39; character in URL paths. The request.path is passed through the unquote_plus function, which converts the &#39;+&#39; character to a space &#39; &#39;. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues.</p> https://vulnerability.circl.lu/vuln/pysec-2026-1385