Vulnerabilities

TI-2026-65443 CVE-2026-102598 · GHSA-g6x2-hccm-hh4m

Werkzeug safe_join() allows Windows special device names

LOW 34

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0037 Published 2026-09-29 Partial fix · 3.1.9 CWE-67

TI-2026-06360 CVE-2026-7246

[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

HIGH 67

This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project.

CVSS 3.1HIGH 7.2 Local High privileges User interaction EPSS 0.009 Published 2026-04-30 Fixed in 8.3.3 CWE-77

TI-2026-21640 CVE-2026-27205 · GHSA-68rp-wp8r-4726

Flask session does not add `Vary: Cookie` header when accessed in some ways

LOW 12

Flask is a web server gateway interface (WSGI) web application framework.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.004 Published 2026-02-21 Partial fix · 3.1.3 CWE-524

TI-2026-21636 CVE-2026-27199 · GHSA-29vq-49wr-vm6x

Werkzeug safe_join() allows Windows special device names

LOW 29

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00631 Published 2026-02-21 Fixed in 3.1.6 CWE-67

TI-2026-17562 CVE-2026-21860 · GHSA-87hc-h4r5-73f7

Werkzeug safe_join() allows Windows special device names with compound extensions

LOW 29

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00475 Published 2026-01-08 Fixed in 3.1.5 CWE-67

TI-2025-40723 CVE-2025-66221 · GHSA-hgf8-39gv-g3f2

Werkzeug safe_join() allows Windows special device names

LOW 35

Werkzeug is a comprehensive WSGI web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00547 Published 2025-11-29 Fixed in 3.1.4 CWE-67

TI-2025-29808 CVE-2025-47278 · GHSA-4grg-w6v8-c28g

Flask uses fallback key instead of current signing key

LOW 9

Flask is a web server gateway interface (WSGI) web application framework.

CVSS 4.0LOW 1.8 Local High privileges No interaction EPSS 0.00192 Published 2025-05-13 Fixed in 3.1.1 CWE-683

TI-2025-20348 CVE-2025-27516 · GHSA-cpwx-vrp4-4pq7

Jinja sandbox breakout through attr filter selecting format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00507 Published 2025-03-05 Partial fix · 3.1.6 CWE-1336

TI-2024-37287 CVE-2024-56326 · GHSA-q2x7-8rv6-6q7h

Jinja has a sandbox breakout through indirect reference to format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00522 Published 2024-12-23 Partial fix · 3.1.5 CWE-1336

TI-2024-37171 CVE-2024-56201 · GHSA-gmj6-6f8f-6699

Jinja has a sandbox breakout through malicious filenames

LOW 26

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00307 Published 2024-12-23 Partial fix · 3.1.5 CWE-150

TI-2024-33234 CVE-2024-49767 · GHSA-q34m-jh98-gwm2

Werkzeug possible resource exhaustion when parsing file data in forms

LOW 39

Werkzeug is a Web Server Gateway Interface web application library.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01095 Published 2024-10-25 Partial fix · 3.0.6, 0.20.0 CWE-400

TI-2024-33233 CVE-2024-49766 · GHSA-f9vj-2wh5-fj8j

Werkzeug safe_join not safe on Windows

LOW 29

Werkzeug is a Web Server Gateway Interface web application library.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00776 Published 2024-10-25 Fixed in 3.0.6 CWE-22

TI-2024-22527 CVE-2024-34069 · GHSA-2g68-c3qc-8985

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

MEDIUM 41

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.03397 Published 2024-05-06 Partial fix · 3.0.3 CWE-352

TI-2024-22522 CVE-2024-34064 · GHSA-h75v-3vvj-5mfj

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

LOW 26

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00979 Published 2024-05-06 Partial fix · 3.1.4 CWE-79

TI-2024-14788 CVE-2024-22195 · GHSA-h5c8-rqwp-cp95

Jinja vulnerable to Cross-Site Scripting (XSS)

LOW 29

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00892 Published 2024-01-11 Partial fix · 3.1.3 CWE-79

TI-2023-24778 CVE-2023-46136 · GHSA-hrfv-mqp8-q5rw

Uncontrolled resource consumption in pallets werkzeug

LOW 37

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.01288 Published 2023-10-24 Partial fix · 3.0.1, 2.3.8 CWE-400

TI-2023-14640 CVE-2023-30861 · GHSA-m2qf-hxjv-5gpq

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

LOW 35

Flask is a lightweight WSGI web application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0125 Published 2023-05-02 Partial fix · 2.3.2, 2.2.5 CWE-539

TI-2023-10880 CVE-2023-25577 · GHSA-xg9f-g7g7-2323

Werkzeug may allow high resource usage when parsing multipart form data with many fields

MEDIUM 42

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0142 Published 2023-02-14 Partial fix · 2.2.3 CWE-770

TI-2023-09732 CVE-2023-23934 · GHSA-px8h-6qxv-m22q

Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

LOW 17

Werkzeug is a comprehensive WSGI web application library.

CVSS 3.1LOW 3.5 Adjacent network No auth User interaction EPSS 0.00507 Published 2023-02-14 Partial fix · 2.2.3 CWE-20

TI-2022-11856 CVE-2022-29361 · GHSA-7wxw-4483-3m34

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers…

MEDIUM 53

Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08067 Published 2022-05-24 No fix listed CWE-444

TI-2020-17297 CVE-2020-28493 · GHSA-g3rq-g295-4j3m

Regular expression denial of service (ReDoS) in jinja2

LOW 30

This affects the package jinja2 from 0.0.0 and before 2.11.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03589 Published 2021-02-01 Partial fix · 2.11.3 CWE-400

TI-2020-17397 CVE-2020-28724 · GHSA-3p3h-qghp-hvh2

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

LOW 31

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01681 Published 2020-11-18 Partial fix · 0.11.6 CWE-601

TI-2019-11011 CVE-2019-14806 · GHSA-gq9m-qvpx-68hc

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN…

LOW 37

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01909 Published 2019-08-09 Partial fix · 0.15.3 CWE-331

TI-2019-10671 CVE-2019-14322 · GHSA-j544-7q9p-6xp8

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

HIGH 66

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.55803 Published 2019-07-28 Fixed in 0.15.5 CWE-22

TI-2019-15971 CVE-2019-1010083 · GHSA-5wv5-4vpf-pj6m

Uncontrolled resource consumption in Pallets Project Flask

LOW 36

The Pallets Project Flask before 1.0 is affected by: unexpected memory usage.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01832 Published 2019-07-17 Partial fix · 1.0 CWE-400

Vulnerabilities

Filters