Login Request a demo
PA
Vendor
Palletsprojects
5 products with CVEs on record
28
CVEs
0
On KEV
0
New 30D
Products
WE
Werkzeug
Palletsprojects
9.8
14 CVEs0 on KEV0 new
JI
Jinja
Palletsprojects
8.8
8 CVEs0 on KEV0 new
FL
Flask
Palletsprojects
7.5
4 CVEs0 on KEV0 new
CL
Click
Palletsprojects
7.2
1 CVEs0 on KEV0 new
QU
Quart
Palletsprojects
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-7246
CL
Click
Palletsprojects
7.2
1%
Apr 30[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
CVE-2026-27205
FL
Flask
Palletsprojects
4.3
0%
Feb 21Flask session does not add `Vary: Cookie` header when accessed in some ways
CVE-2026-27199
WE
Werkzeug
Palletsprojects
5.3
1%
Feb 21Werkzeug safe_join() allows Windows special device names
CVE-2026-21860
WE
Werkzeug
Palletsprojects
5.3
0%
Jan 8Werkzeug is a comprehensive WSGI web application library
CVE-2025-66221
WE
Werkzeug
Palletsprojects
5.3
1%
Nov 29Werkzeug is a comprehensive WSGI web application library
CVE-2025-27516
JI
Jinja
Palletsprojects
8.8
1%
Mar 5Jinja is an extensible templating engine
CVE-2024-56326
JI
Jinja
Palletsprojects
7.8
1%
Dec 23Jinja has a sandbox breakout through indirect reference to format method
CVE-2024-56201
JI
Jinja
Palletsprojects
8.8
0%
Dec 23Jinja has a sandbox breakout through malicious filenames
CVE-2024-49767
QU
Quart
Palletsprojects
7.5
1%
Oct 25Werkzeug is a Web Server Gateway Interface web application library
CVE-2024-49766
WE
Werkzeug
Palletsprojects
5.3
1%
Oct 25Werkzeug is a Web Server Gateway Interface web application library
CVE-2024-34069
WE
Werkzeug
Palletsprojects
7.5
3%
May 6Werkzeug is a comprehensive WSGI web application library
CVE-2024-34064
JI
Jinja
Palletsprojects
5.4
1%
May 6Jinja is an extensible templating engine
CVE-2024-22195
JI
Jinja
Palletsprojects
6.1
1%
Jan 11Jinja is an extensible templating engine
CVE-2023-46136
WE
Werkzeug
Palletsprojects
7.5
1%
Oct 25Werkzeug is a comprehensive WSGI web application library
CVE-2023-30861
FL
Flask
Palletsprojects
7.5
1%
May 2Flask is a lightweight WSGI web application framework
CVE-2023-25577
WE
Werkzeug
Palletsprojects
7.5
1%
Feb 14Werkzeug is a comprehensive WSGI web application library
CVE-2023-23934
WE
Werkzeug
Palletsprojects
3.5
1%
Feb 14Werkzeug is a comprehensive WSGI web application library
CVE-2022-29361
WE
Werkzeug
Palletsprojects
9.8
8%
May 25Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests…
CVE-2020-28493
JI
Jinja
Palletsprojects
5.3
4%
Feb 1This affects the package jinja2 from 0.0.0 and before 2.11.3
CVE-2020-28724
WE
Werkzeug
Palletsprojects
6.1
2%
Nov 18Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL
CVE-2019-14806
WE
Werkzeug
Palletsprojects
7.5
2%
Aug 9Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id
CVE-2019-14322
WE
Werkzeug
Palletsprojects
7.5
56%
Jul 28In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames
CVE-2019-1010083
FL
Flask
Palletsprojects
7.5
2%
Jul 17The Pallets Project Flask before 1.0 is affected by: unexpected memory usage
CVE-2016-10745
JI
Jinja
Palletsprojects
8.6
4%
Apr 8In Pallets Jinja before 2.8.1, str.format allows a sandbox escape
CVE-2019-10906
JI
Jinja
Palletsprojects
8.6
4%
Apr 7In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape
CVE-2018-1000656
FL
Flask
Palletsprojects
7.5
4%
Aug 20The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly…
CVE-2016-10516
WE
Werkzeug
Palletsprojects
6.1
2%
Oct 23Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other…