Improper Handling of Windows Device Names

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Wasmtime doesn't fully sandbox all the Windows device filenamesCVE-2024-51745bytecodealliance · CVSS 2.3 · 0.8% likely

   Bytecodealliance

2. Werkzeug safe_join() allows Windows special device namesCVE-2026-27199pallets · CVSS 6.3 · 0.6% likely

   The Pallets Project

3. Werkzeug safe_join() allows Windows special device namesCVE-2025-66221pallets · CVSS 6.3 · 0.5% likely

   The Pallets Project

4. Werkzeug safe_join() allows Windows special device names with compound extensionsCVE-2026-21860pallets · CVSS 6.3 · 0.5% likely

   The Pallets Project

5. gix refs and paths with reserved Windows device names access the devicesCVE-2024-35197Byron · CVSS 5.4 · 0.4% likely

   Byron

6. Werkzeug safe_join() allows Windows special device namesCVE-2026-102598pallets · CVSS 6.3 · 0.4% likely

   The Pallets Project

7. PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoSCVE-2026-17545PHP Group · CVSS 6.9 · 0.4% likely

   PHP

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.