pallets vulnerabilities
18 published CVEs name pallets among the affected products.
- Published CVEs
- 18
- Last 12 months
- 5
- Critical
- 0
- Known exploited
- 0
Critical 0High 4Medium 11Low 3Not scored 0
CVEs per yearBy the year they were published
- 20234
- 20247
- 20253
- 20264
Newest CVEs
- CVE-2026-102598
Werkzeug safe_join() allows Windows special device names
pallets · werkzeug
Medium6.3 - CVE-2026-27205
Flask session does not add `Vary: Cookie` header when accessed in some ways
pallets · flask
Low2.3 - CVE-2026-27199
Werkzeug safe_join() allows Windows special device names
pallets · werkzeug
Medium6.3 - CVE-2026-21860
Werkzeug safe_join() allows Windows special device names with compound extensions
pallets · werkzeug
Medium6.3 - CVE-2025-66221
Werkzeug safe_join() allows Windows special device names
pallets · werkzeug
Medium6.3 - CVE-2025-47278
Flask uses fallback key instead of current signing key
pallets · flask
Low1.8 - CVE-2025-27516
Jinja sandbox breakout through attr filter selecting format method
pallets · jinja
Medium5.4 - CVE-2024-56326
Jinja has a sandbox breakout through indirect reference to format method
pallets · jinja
Medium5.4 - CVE-2024-56201
Jinja has a sandbox breakout through malicious filenames
pallets · jinja
Medium5.4 - CVE-2024-49767
Werkzeug possible resource exhaustion when parsing file data in forms
pallets · werkzeug
Medium6.9