pallets flask

• CVE-2026-27205 Low 2.3 Flask session does not add `Vary: Cookie` header when accessed in some ways 0.4%
• CVE-2025-47278 Low 1.8 Flask uses fallback key instead of current signing key 0.2%
• CVE-2023-30861 High 7.5 Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header 1.2%