PT-2026-2107

🗓️ 08 Jan 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 1 Views

Werkzeug safe join mishandles Windows device names like CON, allowing access; upgrade to version 3.1.5.

Reporter	Title	Published	Views	Family All 45
IBM Security Bulletins	Security Bulletin: There is a vulnerability in werkzeug-3.1.4-py3-none-any.whl used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-21860)	3 Mar 202604:12	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Werkzeug affects IBM Netezza Appliance	16 Apr 202610:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in werkzeug-3.1.4-py3-none-any.whl	5 Feb 202620:19	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses werkzeug-3.1.4 and urllib3-2.6.2 library which were vulnerable to CVE-2026-21860 and CVE-2026-21441 respectively	6 Mar 202607:07	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses werkzeug-3.1.4-py3-none-any.whl, filelock-3.20.1-py3-none-any.whl which is vulnerable to CVE-2026-21860 and CVE-2026-22701.	31 Mar 202612:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Werkzeug	2 Feb 202619:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability assertj-core, spring-security-crypto, werkzeug, urllib, libsodium, jersey-client, log4j, dmidecode-dmidecode, and aide affect IBM Cloud Object Storage Systems (FEB 2026)	27 Feb 202617:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Predict Component was using vulnerable library werkzeug-3.1.4 which is vulnerable to CVE-2026-21860	27 Mar 202608:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in Werkzeug [CVE-2026-21860]	27 Feb 202615:42	–	ibm

Source	Link
cve	www.cve.org/CVERecord
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2026-21860
github	www.github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7
github	www.github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-21860
twitter	www.twitter.com/CVEnew/status/2009462338295091494
ubuntu	www.ubuntu.com/security/CVE-2026-21860
github	www.github.com/pallets/werkzeug
osv	www.osv.dev/vulnerability/CVE-2026-21860
osv	www.osv.dev/vulnerability/GHSA-87hc-h4r5-73f7

21 Feb 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 46.3

CVSS 3.15.3

EPSS0.00034

SSVC