Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 docx-preview, Stored #CSS Injection to XSS, #CVE-2024-49767 (Medium) -DC-Sep2026-2316 https://dailycve.com/docx-preview-stored-css-injection-to-xss-cve-2024-49767-medium-dc-sep2026-2316/
Post summary
The post announces CVE‑2024‑49767, a medium‑severity vulnerability involving stored CSS injection that can lead to XSS in the docx‑preview component.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | palletsprojects | quart | - | python | - |
| App | palletsprojects | werkzeug | - | - | - |