Werkzeug

This hub aggregates every CVE we track for Werkzeug, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 14 most recently published vulnerabilities affecting Werkzeug.

• CVE-2026-27199Werkzeug safe_join() allows Windows special device names5.3Feb 21, 2026
• CVE-2026-21860Werkzeug safe_join() allows Windows special device names with compound extensions5.3Jan 8, 2026
• CVE-2025-66221Werkzeug safe_join() allows Windows special device names5.3Nov 29, 2025
• CVE-2024-49767Werkzeug possible resource exhaustion when parsing file data in forms7.5Oct 25, 2024
• CVE-2024-49766Werkzeug safe_join not safe on Windows5.3Oct 25, 2024
• CVE-2024-34069Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution7.5May 6, 2024
• CVE-2023-46136Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning8.0Oct 24, 2023
• CVE-2023-25577Werkzeug may allow high resource usage when parsing multipart form data with many fields7.5Feb 14, 2023
• CVE-2023-23934Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass2.6Feb 14, 2023
• CVE-2022-29361Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the bod...9.8May 24, 2022
• CVE-2020-28724Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.6.1Nov 18, 2020
• CVE-2019-14806Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.7.5Aug 9, 2019
• CVE-2019-14322In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.7.5Jul 28, 2019
• CVE-2016-10516Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remo...6.1Oct 23, 2017