CWE-67

7 CVEs classified under CWE-67. Browse by severity and year.

Top CVEs for CWE-67
CVESeverityScorePublishedSummary
CVE-2024-51745Critical10.02024-11-05Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such a…
CVE-2024-35197Medium5.42024-05-23gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths tha…
CVE-2026-27199Medium5.32026-02-21Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded…
CVE-2026-21860Medium5.32026-01-08Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names…
CVE-2025-66221Medium5.32025-11-29Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names…
CVE-2026-1025982026-09-29Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device pa…
CVE-2026-175452026-09-25On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ whe…
All CVEs classified under CWE-67 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-1025982026-09-29Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device pa…
CVE-2026-175452026-09-25On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ whe…
CVE-2026-27199Medium5.32026-02-21Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded…
CVE-2026-21860Medium5.32026-01-08Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names…
CVE-2025-66221Medium5.32025-11-29Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names…
CVE-2024-51745Critical10.02024-11-05Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such a…
CVE-2024-35197Medium5.42024-05-23gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths tha…