| CVE-2023-46136 |
high |
7.5 |
7.5 |
|
|
|
3y ago |
Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are a… |
| CVE-2016-10516 |
medium |
6.1 |
6.1 |
|
|
|
9y ago |
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote… |
| CVE-2024-49767 |
medium |
— |
5.5 |
|
|
|
2y ago |
Werkzeug possible resource exhaustion when parsing file data in forms |
| CVE-2024-34069 |
unknown |
— |
1.0 |
|
|
|
2y ago |
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This r… |
| CVE-2019-14322 |
unknown |
— |
1.0 |
|
|
|
4y ago |
Pallets Werkzeug vulnerable to Path Traversal |
| CVE-2026-27199 |
unknown |
— |
— |
|
|
|
3mo ago |
Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previo… |
| CVE-2026-21860 |
unknown |
— |
— |
|
|
|
5mo ago |
Werkzeug safe_join() allows Windows special device names with compound extensions |
| CVE-2025-66221 |
unknown |
— |
— |
|
|
|
6mo ago |
Werkzeug safe_join() allows Windows special device names |
| CVE-2024-49766 |
unknown |
— |
— |
|
|
|
2y ago |
Werkzeug safe_join not safe on Windows |
| CVE-2023-23934 |
unknown |
— |
— |
|
|
|
3y ago |
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised applicatio… |
| CVE-2023-25577 |
unknown |
— |
— |
|
|
|
3y ago |
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a s… |
| CVE-2022-29361 |
unknown |
— |
— |
|
|
|
4y ago |
** DISPUTED ** Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included i… |
| CVE-2020-28724 |
unknown |
— |
— |
|
|
|
5y ago |
Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. |
| CVE-2019-14806 |
unknown |
— |
— |
|
|
|
7y ago |
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. |
