KKludex

Products

Exploited and recent CVEs

• CVE-2026-48710 Medium 6.5 Exploited Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks 70.3%
• CVE-2026-53540 Low 3.7 Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory 0.3%
• CVE-2026-53537 Low 3.7 Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters 0.3%
• CVE-2026-53538 Low 3.7 Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling 0.3%
• CVE-2026-53539 High 7.5 Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service 0.5%
• CVE-2026-54283 High 7.5 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS 0.5%
• CVE-2026-54282 Low 3.7 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname 0.3%
• CVE-2026-48817 Medium 5.3 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` 0.2%
• CVE-2026-48818 High 7.5 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows 0.4%
• CVE-2026-42561 High 7.5 Python-Multipart: Denial of Service via unbounded multipart part headers 0.7%
• CVE-2026-40347 Medium 5.3 Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data 0.4%
• CVE-2026-24486 High 8.6 Python-Multipart has Arbitrary File Write via Non-Default Configuration 2.2%
• CVE-2025-62727 High 7.5 Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse 0.8%
• CVE-2024-53981 High 7.5 python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary 0.6%
• CVE-2024-24762 High 7.5 python-multipart vulnerable to content-type header Regular expression Denial of Service 1.5%