werkzeug vulnerabilities

CVEs whose affected-version data names the werkzeug package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

11 CVEsRSS

CVE-2026-102598Medium· 6.3

Werkzeug is a comprehensive WSGI web application library

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an …

▾ Sunlitpallets · werkzeugEPSS 0.37%via NVD

CVE-2026-27199MediumPoC

Werkzeug safe_join() allows Windows special device names

Werkzeug safe_join() allows Windows special device names

▾ Twilightwerkzeug · werkzeugEPSS 0.63%via OSV

CVE-2026-21860Medium· 5.3

Werkzeug safe_join() allows Windows special device names with compound extensions

Werkzeug safe_join() allows Windows special device names with compound extensions

▾ Sunlitwerkzeug · werkzeugEPSS 0.47%via OSV

CVE-2025-66221Medium· 5.3

Werkzeug is a comprehensive WSGI web application library

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are imp…

▾ Sunlitpalletsprojects · werkzeugEPSS 0.51%via NVD

CVE-2024-49767High· 7.5

Werkzeug possible resource exhaustion when parsing file data in forms

Werkzeug possible resource exhaustion when parsing file data in forms

▾ Twilightwerkzeug · werkzeugEPSS 1.1%via OSV

CVE-2024-49766Medium

Werkzeug safe_join not safe on Windows

Werkzeug safe_join not safe on Windows

▾ Sunlitwerkzeug · werkzeugEPSS 0.78%via OSV

CVE-2024-34069High· 7.5PoC

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

▾ Midnightwerkzeug · werkzeugEPSS 3.4%via OSV

CVE-2023-46136Medium· 5.7PoC

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

▾ Twilightwerkzeug · werkzeugEPSS 1.3%via OSV

CVE-2023-25577High· 7.5

High resource usage when parsing multipart form data with many fields

High resource usage when parsing multipart form data with many fields

▾ Twilightwerkzeug · werkzeugEPSS 1.4%via OSV

CVE-2023-23934Low· 2.6

Incorrect parsing of nameless cookies leads to __Host- cookies bypass

Incorrect parsing of nameless cookies leads to __Host- cookies bypass

▾ Sunlitwerkzeug · werkzeugEPSS 0.51%via OSV

CVE-2019-14322High· 7.5PoC

Pallets Werkzeug vulnerable to Path Traversal

Pallets Werkzeug vulnerable to Path Traversal

▾ Midnightwerkzeug · werkzeugEPSS 56%via OSV

werkzeug vulnerabilities (CVEs) · VulnSea