Starlette - Improper Validation of Unsafe Equivalence in Input

A flaw was found in Starlette, a lightweight ASGI Asynchronous Server Gateway Interface framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when it is configured as an empty list. As a result, authenticated users can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on columns ...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

EUVD-2026-76772

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

PT-2026-90553

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality a...

CVE-2026-48710

CVE-2026-48710 Principio: Starlette es un framework ASGI ligero y de código abierto para Python. El problema surge de que el framework Starlette, al procesar la estructura de datos de la URL, confía en el host enviado por el cliente y lo concatena directamente a la variable url para el posterior...

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

CVE-2025-62727-Demo

CVE-2025-62727 Demo Victim Description The target victim of CVE-2025-62727 is a simple FastAPI app that: Serves Hello World at /. Serves static files under /static using Starlette's StaticFiles. Auto-generates text files containing A repeated N times for N in 1024, 2048, 50176 on startup. How to...

ROOT-APP-PYPI-GHSA-93GM-QMQ6-W238 GHSA-93gm-qmq6-w238 in starlette - Patched by Root

Root has patched GHSA-93gm-qmq6-w238 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48818 CVE-2026-48818 in starlette - Patched by Root

Root has patched CVE-2026-48818 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-54121 CVE-2025-54121 in starlette - Patched by Root

Root has patched CVE-2025-54121 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-47874 CVE-2024-47874 in starlette - Patched by Root

Root has patched CVE-2024-47874 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-QJ8W-RV5X-2V9H GHSA-qj8w-rv5x-2v9h in starlette - Patched by Root

Root has patched GHSA-qj8w-rv5x-2v9h in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-3QJ8-93XH-PWH2 GHSA-3qj8-93xh-pwh2 in starlette - Patched by Root

Root has patched GHSA-3qj8-93xh-pwh2 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-54283 CVE-2026-54283 in starlette - Patched by Root

Root has patched CVE-2026-54283 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-30798 CVE-2023-30798 in starlette - Patched by Root

Root has patched CVE-2023-30798 in the starlette package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48710 CVE-2026-48710 in starlette - Patched by Root

Root has patched CVE-2026-48710 in the starlette package for Root:PyPI. Multiple fixed versions available...

starlette-host-header-lab

Lab de Confusión de URL por Host-Header en Starlette X41-2026-002 Un laboratorio de formación autónomo y contenerizado que reproduce la vulnerabilidad de omisión de autenticación en Starlette divulgada por X41 D-Sec. Aviso: X41-2026-002 GHSA: GHSA-86qp-5c8j-p5mr CWE: 436 — Conflicto de...