Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: tornadoweb tornado 6.6 Clear all filters
TI-2026-86677 CVE-2026-123535 · GHSA-cfc4-jgx9-vvjh

Cookie attribute injection in Tornado via set_cookie max_age

Priority LOW 11

Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00174 Published 2026-11-08 Fixed in 6.6 CWE-74
TI-2026-86676 CVE-2026-123534 · GHSA-xc53-2vgx-jv3x

Path traversal in Tornado static_url() version hashing

Priority LOW 36

Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00338 Published 2026-11-08 Fixed in 6.6 CWE-22