tornadoweb vulnerabilities
Every vulnerability this feed holds for tornadoweb, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
5 vulnerabilities tracked.
- 8.7 Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to…
- 8.3 Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.staticurl() and getversion() that allows attackers to hash…
- 7.5 Tornado is a Python web framework and asynchronous networking library.
- 7.5 Tornado is a Python web framework and asynchronous networking library.
- 2.3 Tornado before 6.6 does not validate the maxage argument of RequestHandler.setcookie (also called by setsignedcookie, setsecurecookie, and…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that tornadoweb is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Linux Red Hat Google Microsoft Apple IBM Apache Software Foundation zephyrproject n/a Oracle Corporation Unknown JetBrains Drupal Cisco Tanium go-vikunja Eclipse Foundation hickory-dns Samsung Semiconductor SuiteCRM wazuh HCL Software Gnome vercel