pallets/werkzeug Security Advisories | GitStock

medium2026-10-05

Werkzeug safe_join() allows Windows special device names

GHSA-g6x2-hccm-hh4m · CVE-2026-102598

medium2026-02-19

Werkzeug safe_join() allows Windows special device names

GHSA-29vq-49wr-vm6x · CVE-2026-27199

medium2026-01-08

Werkzeug safe_join() allows Windows special device names with compound extensions

GHSA-87hc-h4r5-73f7 · CVE-2026-21860

medium2025-12-02

Werkzeug safe_join() allows Windows special device names

GHSA-hgf8-39gv-g3f2 · CVE-2025-66221

medium2024-10-25

Werkzeug possible resource exhaustion when parsing file data in forms

GHSA-q34m-jh98-gwm2 · CVE-2024-49767

medium2024-10-25

Werkzeug safe_join not safe on Windows

GHSA-f9vj-2wh5-fj8j · CVE-2024-49766

high2024-05-06

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

GHSA-2g68-c3qc-8985 · CVE-2024-34069

medium2023-10-25

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

GHSA-hrfv-mqp8-q5rw · CVE-2023-46136

low2023-02-15

Incorrect parsing of nameless cookies leads to __Host- cookies bypass

GHSA-px8h-6qxv-m22q · CVE-2023-23934

high2023-02-15

High resource usage when parsing multipart form data with many fields

GHSA-xg9f-g7g7-2323 · CVE-2023-25577

high2022-05-24

Pallets Werkzeug vulnerable to Path Traversal

GHSA-j544-7q9p-6xp8 · CVE-2019-14322

medium2022-05-14

Pallets Werkzeug cross-site scripting vulnerability

GHSA-h2fp-xgx6-xh6f · CVE-2016-10516