CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...

CVE-2026-82852

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

CVE-2026-82228

Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...

CVE-2026-82221

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82224

Unauthenticated Cross Site Scripting XSS in SliceWP = 1.2.10 versions...

CVE-2026-82225

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-82229

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-81780

Unauthenticated Arbitrary File Upload in Hash Form = 1.4.2 versions...

CVE-2026-81763

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

CVE-2026-81765

Unauthenticated Cross Site Scripting XSS in Tailored Tools = 3.0.2 versions...

CVE-2026-81768

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81764

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81298

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

CVE-2026-81291

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-81756

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...