EN
Vendor
Encode
16
CVEs
1
On KEV
3
New 30D
Products
DJ7.5
django-rest-framework
encode
6 CVEs0 on KEV3 new
ST7.5
Starlette
Encode
7 CVEs1 on KEV0 new
UV7.5
Uvicorn
Encode
2 CVEs0 on KEV0 new
HT9.1
Httpx
Encode
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114138 New | DJ django-rest-framework encode | 7.5 | Oct 21 | Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation |
| CVE-2026-114137 New | DJ django-rest-framework encode | 7.4 | Oct 21 | Django REST framework: TokenProxy.delete() reports success and revokes nothing |
| CVE-2026-114136 New | DJ django-rest-framework encode | 7.5 | Oct 21 | Django REST framework: JSONParser applies an attacker-named codec to the request stream |
| CVE-2026-73229 | DJ django-rest-framework encode | 4.3 | Aug 11 | Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests |
| CVE-2026-73228 | DJ django-rest-framework encode | 5.3 | Aug 11 | Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data` |
| CVE-2026-54283 | ST Starlette Encode | 7.5 | Jun 22 | Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS |
| CVE-2026-54282 | ST Starlette Encode | 5.3 | Jun 22 | Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname |
| CVE-2026-48817 | ST Starlette Encode | 5.3 | Jun 17 | Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` |
| CVE-2026-48818 | ST Starlette Encode | 7.5 | Jun 17 | Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows |
| CVE-2026-48710 In wildKEV | ST Starlette Encode | 6.5 | May 26 | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks |
| CVE-2023-29159 | ST Starlette Encode | 7.5 | Jun 1 | Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was… |
| CVE-2023-30798 | ST Starlette Encode | 7.5 | Apr 21 | There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or… |
| CVE-2021-41945 | HT Httpx Encode | 9.1 | Apr 28 | Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with` |
| CVE-2020-25626 | DR Django Rest Framework Encode | 6.1 | Sep 30 | A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2 |
| CVE-2020-7695 | UV Uvicorn Encode | 5.3 | Jul 27 | Uvicorn before 0.11.7 is vulnerable to HTTP response splitting |
| CVE-2020-7694 | UV Uvicorn Encode | 7.5 | Jul 27 | This affects all versions of package uvicorn |