https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:07:55 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2025-66221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2025-66221 https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2025-66221 <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Werkzeug&#39;s `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> <p><strong>Affected:</strong> Homebrew: aws-sam-cli</p> <p>Werkzeug&#39;s `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> https://cve.radiocsirt.org/vuln/brew-aws-sam-cli-cve-2025-66221 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1064 certfr-2025-avi-1064 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1064 https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Multiple security vulnerabilities affect the airflow-3 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-az09261 https://cve.radiocsirt.org/vuln/euvd-2026-262100 EUVD-2026-262100 https://cve.radiocsirt.org/vuln/euvd-2026-262100 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66221 <p>Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug&#39;s safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.</p> <p>Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug&#39;s safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66221 https://cve.radiocsirt.org/vuln/ghsa-hgf8-39gv-g3f2 <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug&#39;s `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug&#39;s `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> https://cve.radiocsirt.org/vuln/ghsa-hgf8-39gv-g3f2 https://cve.radiocsirt.org/vuln/msrc_cve-2025-66221 msrc_CVE-2025-66221 https://cve.radiocsirt.org/vuln/msrc_cve-2025-66221 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15848-1 <p>python311-openapi-core-0.22.0-1.1 on GA media</p> <p>python311-openapi-core-0.22.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15848-1 https://cve.radiocsirt.org/vuln/pysec-2026-2046 <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug&#39;s `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> <p><strong>Affected:</strong> PyPI: werkzeug</p> <p>Werkzeug&#39;s `safe_join` function allows path segments with Windows device names. On Windows, there are special device names such as `CON`, `AUX`, etc that are implicitly present and readable in every directory. `send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2046 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-werkzeug, Ubuntu:Pro:18.04:LTS: python-werkzeug, Ubuntu:20.04:LTS: python-werkzeug, Ubuntu:22.04:LTS: python-werkzeug, Ubuntu:24.04:LTS: python-werkzeug, Ubuntu:25.10: python-werkzeug, Ubuntu:25.04: python-werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug&#39;s safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-werkzeug, Ubuntu:Pro:18.04:LTS: python-werkzeug, Ubuntu:20.04:LTS: python-werkzeug, Ubuntu:22.04:LTS: python-werkzeug, Ubuntu:24.04:LTS: python-werkzeug, Ubuntu:25.10: python-werkzeug, Ubuntu:25.04: python-werkzeug</p> <p>Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug&#39;s safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-66221 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933 <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2933