Agendaless maintains a focused portfolio of Python web infrastructure components, most notably the Waitress application server and Pyramid web framework, which serve as foundational elements in many Python-based deployments. The vulnerability profile centers on a recurring set of HTTP-handling and concurrency issues—including HTTP request smuggling, race conditions, path traversal, and resource-lifecycle defects—that reflect the complexity of correctly implementing HTTP semantics and thread-safe request processing in a high-concurrency server. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Agendaless over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-16789HIGH In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed different | Dec 26, 2019 | 8.2 | 27 | NO | NO |
CVE-2022-24761HIGH Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly validate the incoming HTTP | Mar 17, 2022 | 7.5 | 26 | NO | NO |
CVE-2019-16785HIGH Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a reci | Dec 20, 2019 | 7.5 | 26 | NO | NO |
CVE-2019-16786HIGH Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Con | Dec 20, 2019 | 7.5 | 25 | NO | NO |
CVE-2019-16792HIGH Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unabl | Jan 22, 2020 | 7.5 | 24 | NO | NO |
CVE-2024-49769HIGH Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitr | Oct 29, 2024 | 7.5 | 21 | NO | NO |
CVE-2024-49768MEDIUM Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary | Oct 29, 2024 | 4.8 | 20 | NO | NO |
CVE-2020-5236MEDIUM Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it wi | Feb 4, 2020 | 6.5 | 18 | NO | NO |
CVE-2023-40587MEDIUM Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view | Aug 25, 2023 | 5.3 | 17 | NO | NO |
CVE-2022-31015MEDIUM Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread i | May 31, 2022 | 5.9 | 17 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Agendaless.
Media articles that mention a CVE ID that affects a product developed by Agendaless — matched by CVE ID, not by vendor name.