Palletsprojects Werkzeug vulnerabilities

• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2026-27199 Public exploitFix available 6.3 MediumFebruary 19, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names with compound extensions CVE-2026-21860 Fix available 6.3 MediumJanuary 8, 2026
• pallets werkzeug Werkzeug safe_join() allows Windows special device names CVE-2025-66221 Fix available 6.3 MediumNovember 29, 2025
• pallets werkzeug, quart +1 more Werkzeug possible resource exhaustion when parsing file data in forms CVE-2024-49767 Fix available 6.9 MediumOctober 25, 2024
• pallets werkzeug Werkzeug safe_join not safe on Windows CVE-2024-49766 Fix available 6.3 MediumOctober 25, 2024
• pallets werkzeug, debian linux, fedoraproject fedora +2 more Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVE-2024-34069 Public exploitFix available 7.5 HighMay 6, 2024
• pallets werkzeug Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning CVE-2023-46136 Public exploitFix available 8.0 HighOctober 24, 2023
• pallets werkzeug Werkzeug may allow high resource usage when parsing multipart form data with many fields CVE-2023-25577 Fix available 7.5 HighFebruary 14, 2023
• pallets werkzeug Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass CVE-2023-23934 Fix available 2.6 LowFebruary 14, 2023
• palletsprojects werkzeug Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to... CVE-2022-29361 Public exploitFix availableDisputed 9.8 CriticalMay 24, 2022
• palletsprojects werkzeug Open Redirect in werkzeug CVE-2020-28724 Fix available 6.1 MediumNovember 18, 2020
• palletsprojects werkzeug, opensuse leap +1 more Pallets Werkzeug Insufficient Entropy CVE-2019-14806 Fix available 7.5 HighAugust 9, 2019
• palletsprojects werkzeug Pallets Werkzeug vulnerable to Path Traversal CVE-2019-14322 Public exploitFix available EPSS 55.8% 7.5 HighJuly 28, 2019
• palletsprojects werkzeug Pallets Werkzeug cross-site scripting vulnerability CVE-2016-10516 Fix available 6.1 MediumOctober 23, 2017