CVE-2026-73229 | Medium | 4.3 | 2026-08-11 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRende… |
CVE-2026-73228 | Medium | 5.3 | 2026-08-11 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._p… |
CVE-2026-54283 | High | 7.5 | 2026-06-22 | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption wh… |
CVE-2026-54282 | Low | 3.7 | 2026-06-22 | Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because… |
CVE-2026-48817 | Medium | 5.3 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the… |
CVE-2026-48818 | High | 7.5 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker… |
CVE-2026-48710 | Medium | 6.5 | 2026-05-26 | Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `r… |
CVE-2025-54121 | Medium | 5.3 | 2025-07-21 | Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python. In versions 0.47… |
CVE-2024-47874 | | | 2024-10-15 | Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a… |
CVE-2024-24762 | High | 7.5 | 2024-02-05 | `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Ty… |
CVE-2023-29159 | High | 7.5 | 2023-06-01 | Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web se… |
CVE-2023-30798 | High | 7.5 | 2023-04-21 | There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number o… |
CVE-2021-41945 | Critical | 9.1 | 2022-04-28 | Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. |
CVE-2020-25626 | Medium | 6.1 | 2020-09-30 | A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to proper… |
CVE-2020-7695 | Medium | 5.3 | 2020-07-27 | Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add… |
CVE-2020-7694 | Low | 3.7 | 2020-07-27 | This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP req… |