Vulnerabilities

TI-2026-21636 CVE-2026-27199 · GHSA-29vq-49wr-vm6x

Werkzeug safe_join() allows Windows special device names

LOW 29

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00631 Published 2026-02-21 Fixed in 3.1.6 CWE-67

TI-2026-17562 CVE-2026-21860 · GHSA-87hc-h4r5-73f7

Werkzeug safe_join() allows Windows special device names with compound extensions

LOW 29

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00475 Published 2026-01-08 Fixed in 3.1.5 CWE-67

TI-2025-40723 CVE-2025-66221 · GHSA-hgf8-39gv-g3f2

Werkzeug safe_join() allows Windows special device names

LOW 35

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00547 Published 2025-11-29 Fixed in 3.1.4 CWE-67

TI-2024-33234 CVE-2024-49767 · GHSA-q34m-jh98-gwm2

Werkzeug possible resource exhaustion when parsing file data in forms

LOW 39

Werkzeug is a Web Server Gateway Interface web application library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01095 Published 2024-10-25 Partial fix · 3.0.6, 0.20.0 CWE-400

TI-2024-33233 CVE-2024-49766 · GHSA-f9vj-2wh5-fj8j

Werkzeug safe_join not safe on Windows

LOW 29

Werkzeug is a Web Server Gateway Interface web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00776 Published 2024-10-25 Fixed in 3.0.6 CWE-22

TI-2024-22527 CVE-2024-34069 · GHSA-2g68-c3qc-8985

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

MEDIUM 41

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.03397 Published 2024-05-06 Partial fix · 3.0.3 CWE-352

TI-2023-24778 CVE-2023-46136 · GHSA-hrfv-mqp8-q5rw

Uncontrolled resource consumption in pallets werkzeug

LOW 37

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.01288 Published 2023-10-24 Partial fix · 3.0.1, 2.3.8 CWE-400

TI-2023-10880 CVE-2023-25577 · GHSA-xg9f-g7g7-2323

Werkzeug may allow high resource usage when parsing multipart form data with many fields

MEDIUM 42

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0142 Published 2023-02-14 Partial fix · 2.2.3 CWE-770

TI-2023-09732 CVE-2023-23934 · GHSA-px8h-6qxv-m22q

Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

LOW 17

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1LOW 3.5 Adjacent network No auth User interaction EPSS 0.00507 Published 2023-02-14 Partial fix · 2.2.3 CWE-20

TI-2022-11856 CVE-2022-29361 · GHSA-7wxw-4483-3m34

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers…

MEDIUM 53

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08067 Published 2022-05-24 No fix listed CWE-444

TI-2020-17397 CVE-2020-28724 · GHSA-3p3h-qghp-hvh2

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

LOW 31

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01681 Published 2020-11-18 Partial fix · 0.11.6 CWE-601

TI-2019-11011 CVE-2019-14806 · GHSA-gq9m-qvpx-68hc

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN…

LOW 37

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01909 Published 2019-08-09 Partial fix · 0.15.3 CWE-331

TI-2019-10671 CVE-2019-14322 · GHSA-j544-7q9p-6xp8

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

HIGH 66

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.55803 Published 2019-07-28 Fixed in 0.15.5 CWE-22

TI-2016-08558 CVE-2016-10516 · GHSA-h2fp-xgx6-xh6f

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py…

LOW 31

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01985 Published 2017-10-23 Partial fix · 0.11.11 CWE-79

Vulnerabilities

Filters