Browse CVEs

MEDIUM 5.3 CVE-2026-35536 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were n… Tornado 6.5.5+ Fix from $1,6002026-04-03 HIGH 7.5 CVE-2026-31958 Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts i… Tornado 6.5.5+ Fix from $1,9502026-03-11 HIGH 7.5 CVE-2025-67726 Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters … Tornado 6.5.3+ Fix from $1,9502025-12-12 HIGH 7.5 CVE-2025-67725 Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can blo… Tornado 6.5.3+ Fix from $1,9502025-12-12 MEDIUM 6.1 CVE-2025-67724 Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in H… Tornado 6.5.3+ Fix from $1,6002025-12-12 HIGH 7.5 CVE-2024-52804 Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2… Tornado 6.4.2+ Fix from $1,9502024-11-22 MEDIUM 6.1 CVE-2023-28370 Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web sit… Tornado 6.3.2+ Fix from $1,6002023-05-25 MEDIUM 6.5 CVE-2014-9720 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remot… Tornado 3.2.2+ Fix from $1,6002020-01-24 MEDIUM 5.0 CVE-2012-2374 CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrar… Tornado after 2.2 Fix from $1,6002012-05-23