pallets werkzeug vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20243
3. 20251
4. 20263

Newest CVEs

• CVE-2026-102598

  Werkzeug safe_join() allows Windows special device names

  pallets · werkzeug

  Medium6.3
• CVE-2026-27199

  Werkzeug safe_join() allows Windows special device names

  pallets · werkzeug

  Medium6.3
• CVE-2026-21860

  Werkzeug safe_join() allows Windows special device names with compound extensions

  pallets · werkzeug

  Medium6.3
• CVE-2025-66221

  Werkzeug safe_join() allows Windows special device names

  pallets · werkzeug

  Medium6.3
• CVE-2024-49767

  Werkzeug possible resource exhaustion when parsing file data in forms

  pallets · werkzeug

  Medium6.9
• CVE-2024-49766

  Werkzeug safe_join not safe on Windows

  pallets · werkzeug

  Medium6.3
• CVE-2024-34069

  Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

  pallets · werkzeug

  High7.5
• CVE-2023-46136

  Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

  pallets · werkzeug

  High8.0
• CVE-2023-25577

  Werkzeug may allow high resource usage when parsing multipart form data with many fields

  pallets · werkzeug

  High7.5
• CVE-2023-23934

  Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

  pallets · werkzeug

  Low2.6