T
Vendor security profile
tornadoweb
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs14
Critical2
CISA KEV0
Public exploit6
Patch rate%43
Avg. CVSS7.5
12-month vulnerability rate
0
3
0
0
0
1
0
0
0
1
6
3
CVE KEV
CVE severity distribution
14toplam CVE
Critical2 (14%)
High7 (50%)
Medium5 (36%)
Patch and exploitation view
%43
Verified patch
%0
CISA KEV
%43
Public exploit
6Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
8.2
CVE-2026-103263
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
T
Patch verifiedEPSS %1
8.7
CVE-2026-103262
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
T
Patch verifiedEPSS %1
6.9
CVE-2026-103261
Tornado before 6.5.9 Denial of Service via Query String
T
Patch verifiedEPSS %0
8.2
CVE-2026-91992
Tornado before 6.5.7 Credential Leak via Handle Reuse
T
Patch status unknownEPSS %0
6.3
CVE-2026-91991
Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
T
Patch status unknownEPSS %0
8.7
CVE-2026-91990
Tornado before 6.5.8 Memory Amplification DoS via multipart
T
Patch status unknownEPSS %0
6.3
CVE-2024-58384
Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
T
Patch status unknownEPSS %0
9.0
CVE-2024-14029
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
T
Patch status unknownEPSS %0
9.0
CVE-2023-54397
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
T
Patch status unknownEPSS %0
7.5
CVE-2026-82397
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
T
Patch status unknownEPSS %0