Kludex vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20251
3. 202612

Known exploitedNewest addition to KEV first

• CVE-2026-48710

  Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

  Kludex · starlette

  ExploitedMedium6.5

Newest CVEs

• CVE-2026-53540

  Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory

  Kludex · python-multipart

  Low3.7
• CVE-2026-53537

  Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

  Kludex · python-multipart

  Low3.7
• CVE-2026-53538

  Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling

  Kludex · python-multipart

  Low3.7
• CVE-2026-53539

  Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

  Kludex · python-multipart

  High7.5
• CVE-2026-54283

  Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

  Kludex · starlette

  High7.5
• CVE-2026-54282

  Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

  Kludex · starlette

  Low3.7
• CVE-2026-48817

  Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

  Kludex · starlette

  Medium5.3
• CVE-2026-48818

  Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

  Kludex · starlette

  High7.5
• CVE-2026-48710

  Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

  Kludex · starlette

  ExploitedMedium6.5
• CVE-2026-42561

  Python-Multipart: Denial of Service via unbounded multipart part headers

  Kludex · python-multipart

  High7.5