Pallets vulnerabilities

Products

• Werkzeug 10
• Jinja 5
• Flask 4

Newest

• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2026-102598 Fix available 6.3 MediumSeptember 29, 2026
• pallets flask Flask session does not add `Vary: Cookie` header when accessed in some ways CVE-2026-27205 Fix available 2.3 LowFebruary 19, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2026-27199 Public exploitFix available 6.3 MediumFebruary 19, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names with compound extensions CVE-2026-21860 Fix available 6.3 MediumJanuary 8, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2025-66221 Fix available 6.3 MediumNovember 29, 2025
• pallets flask Flask uses fallback key instead of current signing key CVE-2025-47278 Fix available 1.8 LowMay 13, 2025
• pallets jinja, debian linux +1 more Jinja sandbox breakout through attr filter selecting format method CVE-2025-27516 Fix available 5.4 MediumMarch 5, 2025
• pallets jinja Jinja has a sandbox breakout through indirect reference to format method CVE-2024-56326 Fix available 5.4 MediumDecember 23, 2024
• pallets jinja Jinja has a sandbox breakout through malicious filenames CVE-2024-56201 Fix available 5.4 MediumDecember 23, 2024
• pallets werkzeug, quart +1 more Werkzeug possible resource exhaustion when parsing file data in forms CVE-2024-49767 Fix available 6.9 MediumOctober 25, 2024
• pallets werkzeug Werkzeug safe_join not safe on Windows CVE-2024-49766 Fix available 6.3 MediumOctober 25, 2024
• pallets werkzeug, debian linux, fedoraproject fedora +2 more Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVE-2024-34069 Public exploitFix available 7.5 HighMay 6, 2024
• pallets jinja, fedoraproject fedora +1 more Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-34064 Public exploitFix available 5.4 MediumMay 6, 2024
• pallets jinja Jinja vulnerable to Cross-Site Scripting (XSS) CVE-2024-22195 Fix available 5.4 MediumJanuary 11, 2024
• pallets werkzeug Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning CVE-2023-46136 Public exploitFix available 8.0 HighOctober 24, 2023
• pallets flask Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header CVE-2023-30861 Public exploitFix available 7.5 HighMay 1, 2023
• pallets werkzeug Werkzeug may allow high resource usage when parsing multipart form data with many fields CVE-2023-25577 Fix available 7.5 HighFebruary 14, 2023
• pallets werkzeug Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass CVE-2023-23934 Fix available 2.6 LowFebruary 14, 2023
• pallets flask Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage CVE-2019-1010083 Fix available 7.5 HighJuly 17, 2019