Skip to content
Palletsprojects vulnerabilities
Newest
-
pallets click click, red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8 +3 more +5 more
[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
CVE-2026-7246
Fix availableDisputed
7.2 High
-
pallets flask
Flask session does not add `Vary: Cookie` header when accessed in some ways
CVE-2026-27205
Fix available
2.3 Low
-
pallets werkzeug
Werkzeug safe_join() allows Windows special device names
CVE-2026-27199
Public exploitFix available
6.3 Medium
-
pallets werkzeug
Werkzeug safe_join() allows Windows special device names with compound extensions
CVE-2026-21860
Fix available
6.3 Medium
-
pallets werkzeug
Werkzeug safe_join() allows Windows special device names
CVE-2025-66221
Fix available
6.3 Medium
-
pallets jinja, debian linux +1 more
Jinja sandbox breakout through attr filter selecting format method
CVE-2025-27516
Fix available
5.4 Medium
-
pallets jinja
Jinja has a sandbox breakout through indirect reference to format method
CVE-2024-56326
Fix available
5.4 Medium
-
pallets jinja
Jinja has a sandbox breakout through malicious filenames
CVE-2024-56201
Fix available
5.4 Medium
-
pallets werkzeug, quart +1 more
Werkzeug possible resource exhaustion when parsing file data in forms
CVE-2024-49767
Fix available
6.9 Medium
-
pallets werkzeug
Werkzeug safe_join not safe on Windows
CVE-2024-49766
Fix available
6.3 Medium
-
pallets werkzeug, debian linux, fedoraproject fedora +2 more
Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
CVE-2024-34069
Public exploitFix available
7.5 High
-
pallets jinja, fedoraproject fedora +1 more
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
CVE-2024-34064
Public exploitFix available
5.4 Medium
-
pallets jinja
Jinja vulnerable to Cross-Site Scripting (XSS)
CVE-2024-22195
Fix available
5.4 Medium
-
pallets werkzeug
Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2023-46136
Public exploitFix available
8.0 High
-
pallets flask
Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
CVE-2023-30861
Public exploitFix available
7.5 High
-
pallets werkzeug
Werkzeug may allow high resource usage when parsing multipart form data with many fields
CVE-2023-25577
Fix available
7.5 High
-
pallets werkzeug
Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass
CVE-2023-23934
Fix available
2.6 Low
-
palletsprojects werkzeug
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to...
CVE-2022-29361
Public exploitFix availableDisputed
9.8 Critical
-
palletsprojects jinja, fedoraproject fedora +1 more
Regular Expression Denial of Service (ReDoS)
CVE-2020-28493
Fix available
5.3 Medium
-
palletsprojects werkzeug
Open Redirect in werkzeug
CVE-2020-28724
Fix available
6.1 Medium
-
palletsprojects werkzeug, opensuse leap +1 more
Pallets Werkzeug Insufficient Entropy
CVE-2019-14806
Fix available
7.5 High
-
palletsprojects werkzeug
Pallets Werkzeug vulnerable to Path Traversal
CVE-2019-14322
Public exploitFix available
EPSS 55.8%
7.5 High
-
pallets flask
Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage
CVE-2019-1010083
Fix available
7.5 High
-
palletsprojects jinja
Jinja2 sandbox escape vulnerability
CVE-2016-10745
Fix available
8.6 High
-
palletsprojects jinja, canonical ubuntu linux, fedoraproject fedora +2 more +4 more
Jinja2 sandbox escape via string formatting
CVE-2019-10906
Fix available
8.6 High
-
palletsprojects flask, netapp active iq, hyper converged infrastructure +1 more +3 more
Flask is vulnerable to Denial of Service via incorrect encoding of JSON data
CVE-2018-1000656
Fix available
7.5 High
-
palletsprojects werkzeug
Pallets Werkzeug cross-site scripting vulnerability
CVE-2016-10516
Fix available
6.1 Medium