High
CVE-2026-31958
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 34
Reset filters
High
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
Medium
CVE-2025-67724
Tornado vulnerable to Header Injection and XSS via reason argument
High
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
Medium
CVE-2024-58384
Tornado has a CRLF injection in CurlAsyncHTTPClient headers
Medium
CVE-2024-14029
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado
Medium
CVE-2023-54397
Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths
Medium
CVE-2023-28370
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user acce
High
CVE-2014-9720
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determin
High
CVE-2012-2374
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.