Starlette has possible denial-of-service vector when parsing large files in multipart forms

SummaryWhen parsing a multi-part form with large files greater than the default max spool size starlette will block the main thread to roll the file over to disk. This blocks the event thread which means we can't accept new connections. DetailsPlease see this discussion for details:...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-53877 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2026-53878 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

PYSEC-2026-1860 Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting. The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms,...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2024-45231 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Forms versions = 1.9.3.7...

Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

PYSEC-2026-777 Apache Superset is vulnerable to Cross-Site Scripting (XSS)

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0...

SUSE CVE-2026-13848

Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

GHSA-565M-G33J-JQ96 Formie Hidden field defaults vulnerable to Server-Side Template Injection

Summary Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and late...

Formie Hidden field defaults vulnerable to Server-Side Template Injection

Summary Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and late...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the Hidden::getFrontEndInputOptions process. An attacker can execute arbitrary code, access sensitive information, or modify application state by supplying...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Taichi Kashimura in WordPress Plugin NEX-Forms versions = 9.2.2...

CVE-2024-6228

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on t...

EUVD-2024-55649

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on t...

PT-2026-55863

Name of the Vulnerable Software and Affected Versions Notifications for Forms & WordPress Actions versions prior to 2.6 Description Authenticated users with subscriber-level access and above can include and execute arbitrary local PHP files on the server. This occurs because the plugin fails to...

CVE-2024-6228: Undefined Security Weakness

The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on t...

PT-2026-56052

Name of the Vulnerable Software and Affected Versions Formie versions 3.0.0-beta.1 through 3.1.26 Description Formie allows request-derived Hidden field defaults to be passed to the Twig rendering layer during front-end form rendering. An unauthenticated attacker can inject Twig syntax into...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...