Priority HIGH 67
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project.
CVSS 3.1HIGH 7.2· Local · High privileges · User interaction · EPSS 0.009 · Published 2026-04-30 · Fixed in 8.3.3 CWE-77
Priority HIGH 66
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.55803 · Published 2019-07-28 · Fixed in 0.15.5 CWE-22
Priority MEDIUM 53
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08067 · Published 2022-05-24 · No fix listed CWE-444
Priority MEDIUM 44
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.03603 · Published 2019-04-06 · Fixed in 2.10.1 CWE-693
Priority MEDIUM 43
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
CVSS 3.0HIGH 8.6· Network · No auth · No interaction · EPSS 0.0352 · Published 2019-04-08 · Partial fix · 2.8.1 CWE-134
Priority MEDIUM 42
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0142 · Published 2023-02-14 · Partial fix · 2.2.3 CWE-770
Priority MEDIUM 41
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.03397 · Published 2024-05-06 · Partial fix · 3.0.3 CWE-352
Priority LOW 39
Werkzeug is a Web Server Gateway Interface web application library.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01095 · Published 2024-10-25 · Partial fix · 3.0.6, 0.20.0 CWE-400
Priority LOW 39
The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03855 · Published 2018-08-20 · Partial fix · 0.12.3 CWE-20
Priority LOW 37
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1HIGH 8.0· Adjacent network · Low privileges · No interaction · EPSS 0.01288 · Published 2023-10-24 · Partial fix · 3.0.1, 2.3.8 CWE-400
Priority LOW 37
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01909 · Published 2019-08-09 · Partial fix · 0.15.3 CWE-331
Priority LOW 36
The Pallets Project Flask before 1.0 is affected by: unexpected memory usage.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01832 · Published 2019-07-17 · Partial fix · 1.0 CWE-400
Priority LOW 35
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00547 · Published 2025-11-29 · Fixed in 3.1.4 CWE-67
Priority LOW 35
Flask is a lightweight WSGI web application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0125 · Published 2023-05-02 · Partial fix · 2.3.2, 2.2.5 CWE-539
Priority LOW 34
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0037 · Published 2026-09-29 · Partial fix · 3.1.9 CWE-67
Priority LOW 31
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01681 · Published 2020-11-18 · Partial fix · 0.11.6 CWE-601
Priority LOW 31
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject…
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01985 · Published 2017-10-23 · Partial fix · 0.11.11 CWE-79
Priority LOW 30
This affects the package jinja2 from 0.0.0 and before 2.11.3.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03589 · Published 2021-02-01 · Partial fix · 2.11.3 CWE-400
Priority LOW 29
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00631 · Published 2026-02-21 · Fixed in 3.1.6 CWE-67
Priority LOW 29
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00475 · Published 2026-01-08 · Fixed in 3.1.5 CWE-67
Priority LOW 29
Werkzeug is a Web Server Gateway Interface web application library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00776 · Published 2024-10-25 · Fixed in 3.0.6 CWE-22
Priority LOW 29
Jinja is an extensible templating engine.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00892 · Published 2024-01-11 · Partial fix · 3.1.3 CWE-79
Priority LOW 27
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00507 · Published 2025-03-05 · Partial fix · 3.1.6 CWE-1336
Priority LOW 27
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00522 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-1336
Priority LOW 26
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00307 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-150
Load more
THREATIST.IORead the docs