KL
Vendor
Kludex
11
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-53540 | PY python-multipart Kludex | 3.7 | Jun 22 | Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory |
| CVE-2026-53537 | PY python-multipart Kludex | 5.3 | Jun 22 | Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters |
| CVE-2026-53538 | PY python-multipart Kludex | 3.7 | Jun 22 | Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling |
| CVE-2026-53539 | PY python-multipart Kludex | 7.5 | Jun 22 | Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service |
| CVE-2026-54283 | ST starlette Kludex | 7.5 | Jun 22 | Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS |
| CVE-2026-54282 | ST starlette Kludex | 5.3 | Jun 22 | Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname |
| CVE-2026-48817 | ST starlette Kludex | 5.3 | Jun 17 | Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` |
| CVE-2026-48818 | ST starlette Kludex | 7.5 | Jun 17 | Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows |
| CVE-2026-48710 In wildKEV | ST starlette Kludex | 6.5 | May 26 | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks |
| CVE-2026-42561 | PY python-multipart Kludex | 7.5 | May 13 | Python-Multipart: Denial of Service via unbounded multipart part headers |
| CVE-2026-40347 | PY python-multipart Kludex | 5.3 | Apr 17 | Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data |