Vendors / pallets Records 29 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 11
Exploited now pallets records in CISA KEV No pallets vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 66
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.55803 · Published 2019-07-28 · Fixed in 0.15.5 CWE-22
Priority MEDIUM 53
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08067 · Published 2022-05-24 · No fix listed CWE-444
Priority MEDIUM 42
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0142 · Published 2023-02-14 · Partial fix · 2.2.3 CWE-770
Priority MEDIUM 41
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1 HIGH 7.5· Network · No auth · User interaction · EPSS 0.03397 · Published 2024-05-06 · Partial fix · 3.0.3 CWE-352
Priority LOW 39
Werkzeug is a Web Server Gateway Interface web application library.
CVSS 4.0 MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01095 · Published 2024-10-25 · Partial fix · 3.0.6, 0.20.0 CWE-400
Priority LOW 37
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1 HIGH 8.0· Adjacent network · Low privileges · No interaction · EPSS 0.01288 · Published 2023-10-24 · Partial fix · 3.0.1, 2.3.8 CWE-400
Priority LOW 37
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01909 · Published 2019-08-09 · Partial fix · 0.15.3 CWE-331
Priority LOW 35
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00547 · Published 2025-11-29 · Fixed in 3.1.4 CWE-67
Priority LOW 31
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01681 · Published 2020-11-18 · Partial fix · 0.11.6 CWE-601
Priority LOW 31
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject…
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01985 · Published 2017-10-23 · Partial fix · 0.11.11 CWE-79
Priority LOW 29
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00631 · Published 2026-02-21 · Fixed in 3.1.6 CWE-67
Priority LOW 29
Werkzeug is a comprehensive WSGI web application library.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00475 · Published 2026-01-08 · Fixed in 3.1.5 CWE-67
Priority LOW 29
Werkzeug is a Web Server Gateway Interface web application library.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00776 · Published 2024-10-25 · Fixed in 3.0.6 CWE-22
Priority LOW 17
Werkzeug is a comprehensive WSGI web application library.
CVSS 3.1 LOW 3.5· Adjacent network · No auth · User interaction · EPSS 0.00507 · Published 2023-02-14 · Partial fix · 2.2.3 CWE-20
Open these records in search → All records by CVSS severity
1 11 14 3 0
THREATIST.IORead the docs