Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: tornadoweb tornado 6.5.8 Clear all filters
TI-2026-62121 CVE-2026-91991 · GHSA-jj9x-pjq2-f55m

Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Priority MEDIUM 61

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00247 Published 2026-09-15 Partial fix · 6.5.8 CWE-113
TI-2026-62120 CVE-2026-91990 · GHSA-wwvv-qf38-wpf3

Tornado before 6.5.8 Memory Amplification DoS via multipart

Priority HIGH 77

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00424 Published 2026-09-15 Partial fix · 6.5.8 CWE-770