Log in Start free

pallets

Products

ProductCVEsExploitedLatest
werkzeug10–Sep 29, 2026
jinja5–Mar 5, 2025
flask3–Feb 21, 2026
Quart1–Oct 25, 2024

Exploited and recent CVEs

  • CVE-2026-102598 Medium 6.3 Werkzeug safe_join() allows Windows special device names 0.4%
  • CVE-2026-27205 Low 2.3 Flask session does not add `Vary: Cookie` header when accessed in some ways 0.4%
  • CVE-2026-27199 Medium 6.3 Werkzeug safe_join() allows Windows special device names 0.6%
  • CVE-2026-21860 Medium 6.3 Werkzeug safe_join() allows Windows special device names with compound extensions 0.5%
  • CVE-2025-66221 Medium 6.3 Werkzeug safe_join() allows Windows special device names 0.5%
  • CVE-2025-47278 Low 1.8 Flask uses fallback key instead of current signing key 0.2%
  • CVE-2025-27516 Medium 5.4 Jinja sandbox breakout through attr filter selecting format method 0.5%
  • CVE-2024-56326 High 7.8 Jinja has a sandbox breakout through indirect reference to format method 0.5%
  • CVE-2024-56201 Medium 5.4 Jinja has a sandbox breakout through malicious filenames 0.3%
  • CVE-2024-49767 Medium 6.9 Werkzeug possible resource exhaustion when parsing file data in forms 1.1%
  • CVE-2024-49767 Medium 6.9 Werkzeug possible resource exhaustion when parsing file data in forms 1.1%
  • CVE-2024-49766 Medium 6.3 Werkzeug safe_join not safe on Windows 0.8%
  • CVE-2024-34069 High 7.5 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution 3.4%
  • CVE-2024-34064 Medium 5.4 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter 1.0%
  • CVE-2024-22195 Medium 5.4 Jinja vulnerable to Cross-Site Scripting (XSS) 0.9%
  • CVE-2023-46136 High 8.0 Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning 1.3%
  • CVE-2023-30861 High 7.5 Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header 1.2%
  • CVE-2023-25577 High 7.5 Werkzeug may allow high resource usage when parsing multipart form data with many fields 1.4%
  • CVE-2023-23934 Low 2.6 Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass 0.5%