What’s Vulnerable › Products

pallets werkzeug vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your pallets werkzeug version is affected

Latest pallets werkzeug vulnerabilities

• CVE-2026-102598 — Werkzeug safe_join() allows Windows special device names (CVSS 6.3)
• CVE-2026-27199 — Werkzeug safe_join() allows Windows special device names (CVSS 5.3)
• CVE-2026-21860 — Werkzeug safe_join() allows Windows special device names with compound extensions (CVSS 5.3)
• CVE-2025-66221 — Werkzeug safe_join() allows Windows special device names (CVSS 5.3)
• CVE-2024-49767 — Werkzeug possible resource exhaustion when parsing file data in forms (CVSS 7.5)
• CVE-2024-49766 — Werkzeug safe_join not safe on Windows (CVSS 5.3)
• CVE-2024-34069 — Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution (CVSS 7.5)
• CVE-2023-46136 — Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning (CVSS 7.5)
• CVE-2023-25577 — Werkzeug may allow high resource usage when parsing multipart form data with many fields (CVSS 7.5)
• CVE-2023-23934 — Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass (CVSS 3.5)
• CVE-2022-29361 — (CVSS 9.8)
• CVE-2020-28724 — (CVSS 6.1)
• CVE-2019-14806 — (CVSS 7.5)
• CVE-2019-14322 — (CVSS 7.5)
• CVE-2016-10516 — (CVSS 6.1)