PA
Vendor
pallets
16
CVEs
0
On KEV
0
New 30D
Products
WE7.5
werkzeug
pallets
8 CVEs0 on KEV0 new
JI8.8
jinja
pallets
5 CVEs0 on KEV0 new
FL4.3
flask
pallets
2 CVEs0 on KEV0 new
QU7.5
Quart
pallets
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102598 | WE werkzeug pallets | 6.3 | Sep 29 | Werkzeug safe_join() allows Windows special device names |
| CVE-2026-27205 | FL flask pallets | 4.3 | Feb 21 | Flask session does not add `Vary: Cookie` header when accessed in some ways |
| CVE-2026-27199 | WE werkzeug pallets | 5.3 | Feb 21 | Werkzeug safe_join() allows Windows special device names |
| CVE-2026-21860 | WE werkzeug pallets | 5.3 | Jan 8 | Werkzeug safe_join() allows Windows special device names with compound extensions |
| CVE-2025-66221 | WE werkzeug pallets | 5.3 | Nov 29 | Werkzeug safe_join() allows Windows special device names |
| CVE-2025-47278 | FL flask pallets | 1.8 | May 13 | Flask uses fallback key instead of current signing key |
| CVE-2025-27516 | JI jinja pallets | 8.8 | Mar 5 | Jinja sandbox breakout through attr filter selecting format method |
| CVE-2024-56326 | JI jinja pallets | 7.8 | Dec 23 | Jinja has a sandbox breakout through indirect reference to format method |
| CVE-2024-56201 | JI jinja pallets | 8.8 | Dec 23 | Jinja has a sandbox breakout through malicious filenames |
| CVE-2024-49767 | QU Quart pallets | 7.5 | Oct 25 | Werkzeug possible resource exhaustion when parsing file data in forms |
| CVE-2024-49766 | WE werkzeug pallets | 5.3 | Oct 25 | Werkzeug safe_join not safe on Windows |
| CVE-2024-34069 | WE werkzeug pallets | 7.5 | May 6 | Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution |
| CVE-2024-34064 | JI jinja pallets | 5.4 | May 6 | Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter |
| CVE-2024-22195 | JI jinja pallets | 6.1 | Jan 11 | Jinja vulnerable to Cross-Site Scripting (XSS) |
| CVE-2023-46136 | WE werkzeug pallets | 7.5 | Oct 24 | Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning |