# Pallets vulnerabilities

Source: https://junglewise.ai/threats/vendors/pallets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/pallets.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 7 vulnerabilities in Pallets: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102598, was published on 29 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 1
- All time: 7 (0 critical, 0 exploited in the wild)

## About Pallets

Software company that develops web frameworks and utilities for Python applications.

## Latest Pallets vulnerabilities

- [CVE-2026-102598: Werkzeug path traversal via NUL device with NTFS ADS marker](https://junglewise.ai/threats/cve-2026-102598-werkzeug-is-a-comprehensive-wsgi-web-application-library-prior) (medium, CVSS 4, published 29 Sep 2026)
- [CVE-2024-34069: PYSEC-2026-2043 - Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain](https://junglewise.ai/threats/cve-2024-34069-werkzeug-debugger-remote-code-execution-via-attacker-controlled) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2026-7246: Pallets Click command injection in click.edit](https://junglewise.ai/threats/cve-2026-7246-pallets-click-command-injection-in-click-edit) (high, CVSS 7.2, published 30 Apr 2026)
- [CVE-2026-27199: Werkzeug safe_join() allows Windows special device names](https://junglewise.ai/threats/cve-2026-27199-werkzeug-safe-join-allows-windows-special-device-names) (medium, CVSS 4, published 21 Feb 2026)
- [CVE-2024-49767: Pallets Werkzeug resource exhaustion in multipart form parsing](https://junglewise.ai/threats/cve-2024-49767-pallets-werkzeug-resource-exhaustion-in-multipart-form-parsing) (high, CVSS 7.5, published 25 Oct 2024)
- [CVE-2023-46136: Pallets Werkzeug denial of service in multipart parser](https://junglewise.ai/threats/cve-2023-46136-pallets-werkzeug-denial-of-service-in-multipart-parser) (medium, CVSS 5.7, published 25 Oct 2023)
- [CVE-2020-28724: PYSEC-2020-157 - Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.](https://junglewise.ai/threats/cve-2020-28724-werkzeug-open-redirect-via-double-slash-in-url) (low, CVSS 3.1, published 18 Nov 2020)

## Most severe Pallets vulnerabilities

- [CVE-2024-49767: Pallets Werkzeug resource exhaustion in multipart form parsing](https://junglewise.ai/threats/cve-2024-49767-pallets-werkzeug-resource-exhaustion-in-multipart-form-parsing) (high, CVSS 7.5, published 25 Oct 2024)
- [CVE-2026-7246: Pallets Click command injection in click.edit](https://junglewise.ai/threats/cve-2026-7246-pallets-click-command-injection-in-click-edit) (high, CVSS 7.2, published 30 Apr 2026)
- [CVE-2023-46136: Pallets Werkzeug denial of service in multipart parser](https://junglewise.ai/threats/cve-2023-46136-pallets-werkzeug-denial-of-service-in-multipart-parser) (medium, CVSS 5.7, published 25 Oct 2023)
- [CVE-2026-27199: Werkzeug safe_join() allows Windows special device names](https://junglewise.ai/threats/cve-2026-27199-werkzeug-safe-join-allows-windows-special-device-names) (medium, CVSS 4, published 21 Feb 2026)
- [CVE-2026-102598: Werkzeug path traversal via NUL device with NTFS ADS marker](https://junglewise.ai/threats/cve-2026-102598-werkzeug-is-a-comprehensive-wsgi-web-application-library-prior) (medium, CVSS 4, published 29 Sep 2026)
- [CVE-2024-34069: PYSEC-2026-2043 - Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain](https://junglewise.ai/threats/cve-2024-34069-werkzeug-debugger-remote-code-execution-via-attacker-controlled) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2020-28724: PYSEC-2020-157 - Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.](https://junglewise.ai/threats/cve-2020-28724-werkzeug-open-redirect-via-double-slash-in-url) (low, CVSS 3.1, published 18 Nov 2020)

## Vulnerabilities per week

Nothing in the last four weeks, down from 1 vulnerability in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 1 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Pallets vulnerabilities", https://junglewise.ai/threats/vendors/pallets, 9 November 2026.