Skip to content
OpenAdvisories

Package · Alpine

py3-werkzeug

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  • Medium 6.3
    CVE-2026-21860

    Werkzeug safe_join() allows Windows special device names with compound extensions

    Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON…

    pallets werkzeug werkzeug py3-werkzeug Alpine PyPI
  • Medium 6.3
    CVE-2025-66221

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and re…

    pallets werkzeug werkzeug py3-werkzeug Alpine PyPI
  • Medium 6.9
    CVE-2024-49767

    Werkzeug possible resource exhaustion when parsing file data in forms

    Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulner…

    pallets werkzeug Quart airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI