PA
Vendor
Palletsprojects
28
CVEs
0
On KEV
0
New 30D
Products
WE9.8
Werkzeug
Palletsprojects
14 CVEs0 on KEV0 new
JI8.8
Jinja
Palletsprojects
8 CVEs0 on KEV0 new
FL7.5
Flask
Palletsprojects
4 CVEs0 on KEV0 new
CL7.2
Click
Palletsprojects
1 CVEs0 on KEV0 new
QU7.5
Quart
Palletsprojects
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-7246 | CL Click Palletsprojects | 7.2 | Apr 30 | [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()" |
| CVE-2026-27205 | FL Flask Palletsprojects | 4.3 | Feb 21 | Flask session does not add `Vary: Cookie` header when accessed in some ways |
| CVE-2026-27199 | WE Werkzeug Palletsprojects | 5.3 | Feb 21 | Werkzeug safe_join() allows Windows special device names |
| CVE-2026-21860 | WE Werkzeug Palletsprojects | 5.3 | Jan 8 | Werkzeug safe_join() allows Windows special device names with compound extensions |
| CVE-2025-66221 | WE Werkzeug Palletsprojects | 5.3 | Nov 29 | Werkzeug safe_join() allows Windows special device names |
| CVE-2025-27516 | JI Jinja Palletsprojects | 8.8 | Mar 5 | Jinja sandbox breakout through attr filter selecting format method |
| CVE-2024-56326 | JI Jinja Palletsprojects | 7.8 | Dec 23 | Jinja has a sandbox breakout through indirect reference to format method |
| CVE-2024-56201 | JI Jinja Palletsprojects | 8.8 | Dec 23 | Jinja has a sandbox breakout through malicious filenames |
| CVE-2024-49767 | QU Quart Palletsprojects | 7.5 | Oct 25 | Werkzeug possible resource exhaustion when parsing file data in forms |
| CVE-2024-49766 | WE Werkzeug Palletsprojects | 5.3 | Oct 25 | Werkzeug safe_join not safe on Windows |
| CVE-2024-34069 | WE Werkzeug Palletsprojects | 7.5 | May 6 | Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution |
| CVE-2024-34064 | JI Jinja Palletsprojects | 5.4 | May 6 | Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter |
| CVE-2024-22195 | JI Jinja Palletsprojects | 6.1 | Jan 11 | Jinja vulnerable to Cross-Site Scripting (XSS) |
| CVE-2023-46136 | WE Werkzeug Palletsprojects | 7.5 | Oct 24 | Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning |
| CVE-2023-30861 | FL Flask Palletsprojects | 7.5 | May 2 | Flask is a lightweight WSGI web application framework |
| CVE-2023-25577 | WE Werkzeug Palletsprojects | 7.5 | Feb 14 | Werkzeug is a comprehensive WSGI web application library |
| CVE-2023-23934 | WE Werkzeug Palletsprojects | 3.5 | Feb 14 | Werkzeug is a comprehensive WSGI web application library |
| CVE-2022-29361 | WE Werkzeug Palletsprojects | 9.8 | May 25 | Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests… |
| CVE-2020-28493 | JI Jinja Palletsprojects | 5.3 | Feb 1 | This affects the package jinja2 from 0.0.0 and before 2.11.3 |
| CVE-2020-28724 | WE Werkzeug Palletsprojects | 6.1 | Nov 18 | Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL |
| CVE-2019-14806 | WE Werkzeug Palletsprojects | 7.5 | Aug 9 | Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id |
| CVE-2019-14322 | WE Werkzeug Palletsprojects | 7.5 | Jul 28 | In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames |
| CVE-2019-1010083 | FL Flask Palletsprojects | 7.5 | Jul 17 | The Pallets Project Flask before 1.0 is affected by: unexpected memory usage |
| CVE-2016-10745 | JI Jinja Palletsprojects | 8.6 | Apr 8 | In Pallets Jinja before 2.8.1, str.format allows a sandbox escape |
| CVE-2019-10906 | JI Jinja Palletsprojects | 8.6 | Apr 7 | In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape |
| CVE-2018-1000656 | FL Flask Palletsprojects | 7.5 | Aug 20 | The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly… |
| CVE-2016-10516 | WE Werkzeug Palletsprojects | 6.1 | Oct 23 | Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other… |