Pallets - vulnerabilities (CVEs)
18 CVEs in 4 products, 1 in the last 30 days, newest from 2026-09-29.
Products
Newest CVEs of Pallets
- CVE-2026-102598 - CVSS 6.3 (medium), 2026-09-29: Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device…
- CVE-2026-27205 - CVSS 4.3 (medium), 2026-02-21: Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set…
- CVE-2026-27199 - CVSS 6.3 (medium), 2026-02-21: Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if…
- CVE-2026-21860 - CVSS 6.3 (medium), 2026-01-08: Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names…
- CVE-2025-66221 - CVSS 6.3 (medium), 2025-11-29: Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device…
- CVE-2025-47278 - CVSS 1.8 (low), 2025-05-13: Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last…
- CVE-2025-27516 - CVSS 8.8 (high), 2025-03-05: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an…
- CVE-2024-56201 - CVSS 8.8 (high), 2024-12-23: Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the…
- CVE-2024-56326 - CVSS 7.8 (high), 2024-12-23: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker…
- CVE-2024-49767 - CVSS 7.5 (high), 2024-10-25: Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of…
- CVE-2024-49766 - CVSS 6.3 (medium), 2024-10-25: Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share.…
- CVE-2024-34064 - CVSS 5.4 (medium), 2024-05-06: Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML…
- CVE-2024-34069 - CVSS 7.5 (high), 2024-05-06: Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's…
- CVE-2024-22195 - CVSS 6.1 (medium), 2024-01-11: Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary…
- CVE-2023-46136 - CVSS 8 (high), 2023-10-25: Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a…
- CVE-2023-30861 - CVSS 7.5 (high), 2023-05-02: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be…
- CVE-2023-25577 - CVSS 7.5 (high), 2023-02-14: Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of…
- CVE-2023-23934 - CVSS 3.5 (low), 2023-02-14: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable…
