https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:07:33 +0000 https://vulnerability.circl.lu/vuln/cve-2024-49766 <p><strong>Affected:</strong> pallets werkzeug</p> <p>Werkzeug is a Web Server Gateway Interface web application library. On Python &lt; 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug&#39;s safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python &gt;= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.</p> <p><strong>Affected:</strong> pallets werkzeug</p> <p>Werkzeug is a Web Server Gateway Interface web application library. On Python &lt; 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug&#39;s safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python &gt;= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.</p> https://vulnerability.circl.lu/vuln/cve-2024-49766 https://vulnerability.circl.lu/vuln/ghsa-f9vj-2wh5-fj8j <p><strong>Affected:</strong> PyPI: Werkzeug</p> <p>On Python &lt; 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug&#39;s `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python &gt;= 3.11, or not using Windows, are not vulnerable.</p> <p><strong>Affected:</strong> PyPI: Werkzeug</p> <p>On Python &lt; 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug&#39;s `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python &gt;= 3.11, or not using Windows, are not vulnerable.</p> https://vulnerability.circl.lu/vuln/ghsa-f9vj-2wh5-fj8j https://vulnerability.circl.lu/vuln/pysec-2026-2045 <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>On Python &lt; 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug&#39;s `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python &gt;= 3.11, or not using Windows, are not vulnerable.</p> <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>On Python &lt; 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug&#39;s `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python &gt;= 3.11, or not using Windows, are not vulnerable.</p> https://vulnerability.circl.lu/vuln/pysec-2026-2045