Sqlalchemy - vulnerabilities (CVEs)

7 CVEs in 2 products, 1 in the last 30 days, newest from 2026-09-30.

Products

CVE-2026-102991 - CVSS 6.5 (medium), 2026-09-30: Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with…
CVE-2026-44307 - CVSS 8.7 (high), 2026-05-12: Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory…
CVE-2026-41205 - CVSS 7.7 (high), 2026-04-23: Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g.,…
CVE-2022-40023 - CVSS 7.5 (high), 2022-09-07: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and…
CVE-2019-7164 - CVSS 9.8 (critical), 2019-02-20: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
CVE-2019-7548 - CVSS 7.8 (high), 2019-02-06: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
CVE-2012-0805 - CVSS 7.5 (high), 2012-06-05: Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1)…