Skip to content
OpenAdvisories

Vendor

pallets

18 known vulnerabilities.

Products

werkzeug 10 jinja 5 flask 3 Quart 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-27205

    Flask session does not add `Vary: Cookie` header when accessed in some ways

    Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. …

    pallets flask flask flask Debian Ubuntu PyPI
  • Low 1.8
    CVE-2025-47278

    Flask uses fallback key instead of current signing key

    Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the …

    pallets flask flask flask Debian PyPI
  • Low 2.6
    CVE-2023-23934

    Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

    Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie l…

    pallets werkzeug werkzeug python-werkzeug Debian Ubuntu PyPI