Known vulnerabilities in Werkzeug

Software: Werkzeug
Software CPE: cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*
Total vulnerabilities: 16
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Werkzeug Werkzeug is affected by 16 known vulnerabilities: 11 medium, 5 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123583 - Improper Handling of Windows Device Names
CVE-2026-21860
CWE-67 Low
No
No
3.1.5 05.03.2026 SB2026030562
SB2026030633
SB2026030937
and 6 more
#VU123124 - Improper Handling of Windows Device Names
CVE-2026-27199
CWE-67 Medium
No
No
3.1.6 23.02.2026 SB2026022322
SB2026030633
SB2026040615
and 10 more
#VU121123 - Improper Handling of Windows Device Names
CWE-67 Medium
No
No
3.1.5 09.01.2026 SB2026010911
#VU118856 - Improper Handling of Windows Device Names
CVE-2025-66221
CWE-67 Medium
No
No
3.1.4 01.12.2025 SB2025120137
SB2026012033
SB2026013020
and 9 more
#VU99567 - Resource exhaustion
CVE-2024-49767
CWE-400 Medium
No
No
3.0.6 31.10.2024 SB2024103173
SB2024103176
SB2024110601
and 30 more
#VU99566 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-49766
CWE-22 Medium
No
No
3.0.6 31.10.2024 SB2024103173
SB2024121313
SB2024121851
and 16 more
#VU89149 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-34069
CWE-94 Medium
No
No
3.0.3 06.05.2024 SB2024050606
SB2024050723
SB2024050930
and 54 more
#VU82548 - Inefficient Algorithmic Complexity
CVE-2023-46136
CWE-407 Medium
No
No
3.0.1 30.10.2023 SB2023103003
SB2023103183
SB2023112907
and 73 more
#VU72340 - Improper input validation
CVE-2023-23934
CWE-20 Low
No
No
2.2.3 16.02.2023 SB2023021673
SB2023031332
SB2023031613
and 33 more
#VU72339 - Resource exhaustion
CVE-2023-25577
CWE-400 Medium
No
No
2.2.3 16.02.2023 SB2023021673
SB2023022875
SB2023031332
and 49 more
#VU48651 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2020-28724
CWE-601 Medium
No
No
0.11.6 18.11.2020 SB2020112506
SB2020120122
#VU26754 - Use of Insufficiently Random Values
CWE-330 Low
No
No
0.12 09.04.2020 SB2020040926
#VU26753 - Insufficient Entropy
CWE-331 Low
No
No
0.3.1 09.04.2020 SB2020040925
#VU30827 - Insufficient Entropy
CVE-2019-14806
CWE-331 Medium
No
No
0.15.3 09.08.2019 SB2019080917
SB2019091736
SB2019091156
and 4 more
#VU19553 - Improper input validation
CVE-2019-14322
CWE-20 Medium
Available
No
0.15.5 29.07.2019 SB2019072807
SB2024031236
SB2024043020
#VU31406 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-10516
CWE-79 Low
No
No
0.11.11 23.10.2017 SB2017102313
SB2024043020
SB2017112149
and 2 more