Product by Pallets
Werkzeug
10 known vulnerabilities in Werkzeug (Pallets), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-34069 | Pallets Werkzeug: Cross-Site Request Forgery (CSRF) | 7.5 | |
| High | CVE-2023-46136 | Pallets Werkzeug: Inefficient Algorithmic Complexity | 8.0 | |
| High | CVE-2023-25577 | Werkzeug may allow high resource usage when parsing multipart form data with many fields | 7.5 | |
| High | CVE-2024-49767 | Werkzeug possible resource exhaustion when parsing file data in forms | 7.5 | |
| Medium | CVE-2026-102598 | Werkzeug safe_join() allows Windows special device names | — | |
| Medium | CVE-2026-27199 | Werkzeug safe_join() allows Windows special device names | 5.3 | |
| Medium | CVE-2024-49766 | Werkzeug safe_join not safe on Windows | 5.3 | |
| Medium | CVE-2025-66221 | Werkzeug safe_join() allows Windows special device names | 5.3 | |
| Medium | CVE-2026-21860 | Werkzeug safe_join() allows Windows special device names with compound extensions | 5.3 | |
| Low | CVE-2023-23934 | Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass | 2.6 |