EI
Product
Exploit Intelligence
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 5High 10Medium 7Low 1
Watch
Add Exploit Intelligence to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48710 In wildKEV | 6.5 | May 26 | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Affected: All versions, or not specified |
| CVE-2026-94451 | 6.5 | Oct 12 | Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache Affected: All versions, or not specified |
| CVE-2026-93432 | 6.1 | Sep 18 | Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus Affected: All versions, or not specified |
| CVE-2026-42338 | 6.1 | May 12 | ip-address: XSS in Address6 HTML-emitting methods Affected: All versions, or not specified |
| CVE-2026-8643 | 5.5 | Jun 1 | pip can extract console_scripts and gui_scripts outside installation directory Affected: All versions, or not specified |
| CVE-2026-81829 | 5.3 | Sep 17 | Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver Affected: All versions, or not specified |
| CVE-2026-45292 | 5.3 | May 28 | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation Affected: All versions, or not specified |
Showing 7