Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

pallets Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-27205`Flask session does not add `Vary: Cookie` header when accessed in some ways	Exploitation statusNot known exploited	FixYes	Affected productflask	Published02/21/2026	SeverityLow
`CVE-2026-27199`Werkzeug safe_join() allows Windows special device names	Exploitation statusNot known exploited	FixYes	Affected productwerkzeug	Published02/21/2026	SeverityMedium
`CVE-2026-21860`Werkzeug safe_join() allows Windows special device names with compound extensions	Exploitation statusNot known exploited	FixYes	Affected productwerkzeug	Published01/08/2026	SeverityMedium
`CVE-2025-66221`Werkzeug safe_join() allows Windows special device names	Exploitation statusNot known exploited	FixYes	Affected productwerkzeug	Published11/29/2025	SeverityMedium
`CVE-2025-47278`Flask uses fallback key instead of current signing key	Exploitation statusNot known exploited	FixNot confirmed	Affected productflask	Published05/13/2025	SeverityLow
`CVE-2025-27516`Jinja sandbox breakout through attr filter selecting format method	Exploitation statusNot known exploited	FixYes	Affected productjinja	Published03/05/2025	SeverityMedium
`CVE-2024-56326`Jinja has a sandbox breakout through indirect reference to format method	Exploitation statusNot known exploited	FixYes	Affected productjinja	Published12/23/2024	SeverityMedium
`CVE-2024-56201`Jinja has a sandbox breakout through malicious filenames	Exploitation statusNot known exploited	FixYes	Affected productjinja	Published12/23/2024	SeverityMedium
`CVE-2024-49767`Werkzeug possible resource exhaustion when parsing file data in forms	Exploitation statusNot known exploited	FixNot confirmed	Affected productwerkzeug	Published10/25/2024	SeverityMedium
`CVE-2024-49766`Werkzeug safe_join not safe on Windows	Exploitation statusNot known exploited	FixNot confirmed	Affected productwerkzeug	Published10/25/2024	SeverityMedium
`CVE-2024-34069`Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution	Exploitation statusNot known exploited	FixYes	Affected productwerkzeug	Published05/06/2024	SeverityHigh
`CVE-2024-34064`Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter	Exploitation statusNot known exploited	FixYes	Affected productjinja	Published05/06/2024	SeverityMedium
`CVE-2024-22195`Jinja vulnerable to Cross-Site Scripting (XSS)	Exploitation statusNot known exploited	FixNot confirmed	Affected productjinja	Published01/11/2024	SeverityMedium
`CVE-2023-46136`Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning	Exploitation statusNot confirmed	FixYes	Affected productwerkzeug	Published10/24/2023	SeverityHigh
`CVE-2023-30861`Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header	Exploitation statusNot known exploited	FixYes	Affected productflask	Published05/02/2023	SeverityHigh
`CVE-2023-25577`Werkzeug may allow high resource usage when parsing multipart form data with many fields	Exploitation statusNot known exploited	FixNot confirmed	Affected productwerkzeug	Published02/14/2023	SeverityHigh
`CVE-2023-23934`Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass	Exploitation statusNot known exploited	FixYes	Affected productwerkzeug	Published02/14/2023	SeverityLow

17 / 17 Results

All vulnerabilities loaded

Security vulnerabilities from pallets

pallets

Filters

Run an in-depth assessment with complete web risk management

Popular pallets products

werkzeug

jinja

flask

Quart