PT-2026-21351

🗓️ 19 Feb 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 9 Views

Werkzeug safe_join on Windows allowed device names in paths, causing read hang; fixed in 3.1.6.

Reporter	Title	Published	Views	Family All 133
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	1 Apr 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities in the cryptography package	17 Jun 202607:04	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-34073)	4 May 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: Unrestricted upload of file with dangerous type, improper certificate validation, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	24 Jun 202616:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Name Handling in Werkzeug [CVE-2026-27199]	14 Apr 202615:11	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the cryptography package (CVE-2026-34073)	13 Apr 202614:11	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses cryptography-46.0.3, flask-3.1.2 and werkzeug-3.1.5 library which were vulnerable to CVE-2026-26007, CVE-2026-27205 and CVE-2026-27199 respectively	30 Mar 202615:08	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses cryptography-46.0.6, pyasn1-0.6.2, requests-2.32.5 and cryptography-46.0.5 library which were vulnerable to multiple CVEs	5 May 202603:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Werkzeug which is vulnerable to CVE-2026-27199	5 May 202608:38	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34073
osv	www.osv.dev/vulnerability/CVE-2024-12797
osv	www.osv.dev/vulnerability/CVE-2026-40347
github	www.github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d
osv	www.osv.dev/vulnerability/ghsa-87hc-h4r5-73f7
osv	www.osv.dev/vulnerability/CVE-2025-66221
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27205
osv	www.osv.dev/vulnerability/CVE-2026-25645
osv	www.osv.dev/vulnerability/CVE-2026-32597
osv	www.osv.dev/vulnerability/CVE-2026-34517

08 Jun 2026 00:00Current

5.2Medium risk

Vulners AI Score5.2

CVSS 46.3

CVSS 3.15.3

EPSS0.00556

SSVC

werkzeug safe join windows device names read hang version 3.1.6