BadHost-CVE-2026-48710-Exploit

BadHost — Escáner CVE-2026-48710 Escáner de solo detección para la omisión de autenticación BadHost en Starlette / FastAPI — donde el middleware de autenticación lee request.url.path en lugar de request.scope"path", permitiendo que una cabecera Host manipulada introduzca una ruta permitida y omit...

CVE-2026-46645-Analysis-Lab

CVE-2026-46645 - SQLAdmin ajaxlookup Authorization Bypass Executive Summary This repository contains a local Docker lab for reproducing CVE-2026-46645, an authorization bypass vulnerability affecting SQLAdmin's ajaxlookup endpoint. SQLAdmin is an admin interface for SQLAlchemy models in Starlette...

GHSA-6JV3-5F52-599M python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

Summary QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only & as a separator. This creates a parser differential: the same bytes...

CVE-2025-0182

A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. The vulnerability can be exploited by sending...