Kludex starlette

• CVE-2026-48710 Medium 6.5 Exploited Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks 70.3%
• CVE-2026-54283 High 7.5 Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS 0.5%
• CVE-2026-54282 Low 3.7 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname 0.3%
• CVE-2026-48817 Medium 5.3 Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` 0.2%
• CVE-2026-48818 High 7.5 Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows 0.4%
• CVE-2025-62727 High 7.5 Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse 0.8%