WE
Product
Werkzeug
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 6Medium 6Low 1
Watch
Add Werkzeug to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-29361 | 9.8 | May 25 | Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests… Affected: through 2.1.0 |
| CVE-2024-49767 | 7.5 | Oct 25 | Werkzeug possible resource exhaustion when parsing file data in forms Affected: before 3.0.6 |
| CVE-2024-34069 | 7.5 | May 6 | Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution Affected: before 3.0.3 |
| CVE-2023-46136 | 7.5 | Oct 24 | Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning Affected: before 2.3.8; 3.0.0 |
| CVE-2023-25577 | 7.5 | Feb 14 | Werkzeug is a comprehensive WSGI web application library Affected: before 2.2.3 |
| CVE-2019-14806 | 7.5 | Aug 9 | Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id Affected: before 0.15.3 |
| CVE-2019-14322 | 7.5 | Jul 28 | In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames Affected: before 0.15.5 |
| CVE-2020-28724 | 6.1 | Nov 18 | Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL Affected: before 0.11.6 |
| CVE-2016-10516 | 6.1 | Oct 23 | Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other… Affected: before 0.11.11 |
| CVE-2026-27199 | 5.3 | Feb 21 | Werkzeug safe_join() allows Windows special device names Affected: before 3.1.6 |
| CVE-2026-21860 | 5.3 | Jan 8 | Werkzeug safe_join() allows Windows special device names with compound extensions Affected: before 3.1.5 |
| CVE-2025-66221 | 5.3 | Nov 29 | Werkzeug safe_join() allows Windows special device names Affected: before 3.1.4 |
| CVE-2024-49766 | 5.3 | Oct 25 | Werkzeug safe_join not safe on Windows Affected: before 3.0.6 |
| CVE-2023-23934 | 3.5 | Feb 14 | Werkzeug is a comprehensive WSGI web application library Affected: before 2.2.3 |
Showing 14