Pallets Werkzeug vulnerabilities

• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2026-102598 Fix available 6.3 MediumSeptember 29, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2026-27199 Public exploitFix available 6.3 MediumFebruary 19, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names with compound extensions CVE-2026-21860 Fix available 6.3 MediumJanuary 8, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2025-66221 Fix available 6.3 MediumNovember 29, 2025
• pallets werkzeug, quart +1 more Werkzeug possible resource exhaustion when parsing file data in forms CVE-2024-49767 Fix available 6.9 MediumOctober 25, 2024
• pallets werkzeug Werkzeug safe_join not safe on Windows CVE-2024-49766 Fix available 6.3 MediumOctober 25, 2024
• pallets werkzeug, debian linux, fedoraproject fedora +2 more Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVE-2024-34069 Public exploitFix available 7.5 HighMay 6, 2024
• pallets werkzeug Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning CVE-2023-46136 Public exploitFix available 8.0 HighOctober 24, 2023
• pallets werkzeug Werkzeug may allow high resource usage when parsing multipart form data with many fields CVE-2023-25577 Fix available 7.5 HighFebruary 14, 2023
• pallets werkzeug Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass CVE-2023-23934 Fix available 2.6 LowFebruary 14, 2023