MEDIUMPyPI
GHSA-f9vj-2wh5-fj8j· CVE-2024-49766, PYSEC-2026-2045Werkzeug safe_join not safe on Windows
Modified: 9/10/2026
package
PyPI/werkzeug
pkg:pypi/werkzeug
HIGH7.5PyPI
GHSA-gq9m-qvpx-68hc· CVE-2019-14806, PYSEC-2019-140Pallets Werkzeug Insufficient Entropy
Modified: 11/19/2024
MEDIUM6.1PyPI
GHSA-h2fp-xgx6-xh6f· CVE-2016-10516, PYSEC-2017-43Pallets Werkzeug cross-site scripting vulnerability
Modified: 11/19/2024
MEDIUMPyPI
GHSA-hgf8-39gv-g3f2· CVE-2025-66221, PYSEC-2026-2046Werkzeug safe_join() allows Windows special device names
Modified: 9/10/2026
MEDIUM5.7PyPI
GHSA-hrfv-mqp8-q5rw· CVE-2023-46136, PYSEC-2023-221Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-j544-7q9p-6xp8· CVE-2019-14322, PYSEC-2026-1065Pallets Werkzeug vulnerable to Path Traversal
Modified: 7/7/2026
LOW2.6PyPI
GHSA-px8h-6qxv-m22q· CVE-2023-23934, PYSEC-2023-57Incorrect parsing of nameless cookies leads to __Host- cookies bypass
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-q34m-jh98-gwm2· CVE-2024-49767, PYSEC-2026-1860Werkzeug possible resource exhaustion when parsing file data in forms
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-xg9f-g7g7-2323· CVE-2023-25577, PYSEC-2023-58High resource usage when parsing multipart form data with many fields
Modified: 9/10/2026
—PyPI
PYSEC-2017-43· CVE-2016-10516, GHSA-h2fp-xgx6-xh6fModified: 11/8/2023
—PyPI
PYSEC-2019-140· CVE-2019-14806, GHSA-gq9m-qvpx-68hcModified: 11/8/2023
—PyPI
PYSEC-2020-157· CVE-2020-28724, GHSA-3p3h-qghp-hvh2Modified: 11/8/2023
—PyPI
PYSEC-2022-203· CVE-2022-29361Modified: 11/8/2023
HIGH7.5PyPI
PYSEC-2023-221· CVE-2023-46136, GHSA-hrfv-mqp8-q5rwModified: 11/8/2023
—PyPI
PYSEC-2023-57· CVE-2023-23934, GHSA-px8h-6qxv-m22qModified: 11/8/2023
—PyPI
PYSEC-2023-58· CVE-2023-25577, GHSA-xg9f-g7g7-2323Modified: 11/8/2023
HIGH7.5PyPI
PYSEC-2026-1065· CVE-2019-14322, GHSA-j544-7q9p-6xp8Pallets Werkzeug vulnerable to Path Traversal
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-2043· CVE-2024-34069, GHSA-2g68-c3qc-8985Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-2044· CVE-2026-21860, GHSA-87hc-h4r5-73f7Werkzeug safe_join() allows Windows special device names with compound extensions
Modified: 7/7/2026
—PyPI
PYSEC-2026-2045· CVE-2024-49766, GHSA-f9vj-2wh5-fj8jWerkzeug safe_join not safe on Windows
Modified: 7/7/2026
—PyPI
PYSEC-2026-2046· CVE-2025-66221, GHSA-hgf8-39gv-g3f2Werkzeug safe_join() allows Windows special device names
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-2320· CVE-2026-27199, GHSA-29vq-49wr-vm6xModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3417· CVE-2024-49767, GHSA-q34m-jh98-gwm2Werkzeug possible resource exhaustion when parsing file data in forms
Modified: 7/13/2026
MEDIUMPyPI
GHSA-29vq-49wr-vm6x· CVE-2026-27199, PYSEC-2026-2320Werkzeug safe_join() allows Windows special device names
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-2g68-c3qc-8985· CVE-2024-34069, PYSEC-2026-2043Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-3p3h-qghp-hvh2· CVE-2020-28724, PYSEC-2020-157Open Redirect in werkzeug
Modified: 11/19/2024
MEDIUM5.3PyPI
GHSA-87hc-h4r5-73f7· CVE-2026-21860, PYSEC-2026-2044Werkzeug safe_join() allows Windows special device names with compound extensions
Modified: 9/10/2026