Vendor
Pallets Click
27 known vulnerabilities in products by Pallets Click, 0 of them actively exploited (CISA KEV).
Key figures
27
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-29361 | The Pallets Projects Werkzeug: security vulnerability | 9.8 | |
| High | CVE-2019-14322 | The Pallets Projects Werkzeug: security vulnerability | 7.5 | |
| High | CVE-2019-10906 | Palletsprojects Jinja: security vulnerability | 8.6 | |
| High | CVE-2016-10745 | Palletsprojects Jinja: security vulnerability | 8.6 | |
| High | CVE-2024-34069 | Pallets Werkzeug: Cross-Site Request Forgery (CSRF) | 7.5 | |
| High | CVE-2018-1000656 | The Pallets Projects Flask: Improper Input Validation | 7.5 | |
| Medium | CVE-2020-28493 | Regular Expression Denial of Service (ReDoS) | 5.3 | |
| High | CVE-2019-14806 | The Pallets Projects Werkzeug: security vulnerability | 7.5 | |
| High | CVE-2019-1010083 | The Pallets Project Flask: Denial of Service | 7.5 | |
| High | CVE-2023-46136 | Pallets Werkzeug: Inefficient Algorithmic Complexity | 8.0 | |
| Medium | CVE-2016-10516 | The Pallets Projects Werkzeug: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2023-25577 | Werkzeug may allow high resource usage when parsing multipart form data with many fields | 7.5 | |
| High | CVE-2026-7246 | [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()" | 7.2 | |
| High | CVE-2023-30861 | Pallets Flask: Use of Persistent Cookies Containing Sensitive Information | 7.5 | |
| High | CVE-2024-49767 | Werkzeug possible resource exhaustion when parsing file data in forms | 7.5 | |
| Medium | CVE-2020-28724 | The Pallets Projects Werkzeug: Open Redirect | 6.1 | |
| High | CVE-2025-27516 | Jinja sandbox breakout through attr filter selecting format method | 8.8 | |
| Medium | CVE-2026-27199 | Werkzeug safe_join() allows Windows special device names | 5.3 | |
| Medium | CVE-2024-49766 | Werkzeug safe_join not safe on Windows | 5.3 | |
| Medium | CVE-2024-34064 | Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter | 5.4 | |
| High | CVE-2024-56326 | Jinja has a sandbox breakout through indirect reference to format method | 7.8 | |
| Medium | CVE-2025-66221 | Werkzeug safe_join() allows Windows special device names | 5.3 | |
| Medium | CVE-2024-22195 | Jinja vulnerable to Cross-Site Scripting (XSS) | 5.4 | |
| Medium | CVE-2026-21860 | Werkzeug safe_join() allows Windows special device names with compound extensions | 5.3 | |
| High | CVE-2024-56201 | Jinja has a sandbox breakout through malicious filenames | 8.8 |
Products
| The Pallets Projects Werkzeug | 14 | 0 |
| Palletsprojects Jinja | 8 | 0 |
| The Pallets Project Flask | 4 | 0 |