CVE-2026-73555: Generation of Error Message Containing Sensitive Information

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts FastAPI RequestValidationError objects with strexc, and sanitizemessage in vllm/entrypoints/utils.py does not remove traceback-styl...

CVE-2026-67614: Use of Hard-coded Credentials

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...

Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

GHSA-J4JC-CQ9H-XRHR Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

PT-2026-80678

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfill id path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

CVE-2026-68968: Interpretation Conflict

Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the backfillid path segment failed to parse. The authorization dependency parsed it with int while the route handler parsed it as pydantic's NonNegativeInt, which accepts values int rejects 1.0...

VulnCheck KEV: CVE-2026-2652

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

CLSA-2025-1755735112 TuxCare security update for fastapi (1 CVE)

TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.104.1.post1+tuxcare...

CLSA-2025-1754957513 TuxCare security update for fastapi (1 CVE)

TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.63.0.post1+tuxcare...

CLSA-2025-1755043914 TuxCare security update for fastapi (1 CVE)

TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.63.0.post2+tuxcare...

agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: OSV:PYSEC-2026-3556...

PT-2026-73516

TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.63.0.post2+tuxcare...

PT-2026-73519

TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.104.1.post1+tuxcare...

PT-2026-73514

TuxCare rebuilt fastapi to address 1 CVE. Fixed in 0.63.0.post1+tuxcare...

spotlight

Spotlight by CMUL8 The AI security engineer. Phase 1 MVP — ve...

agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: GHSA-442Q-2J6P-642G...

agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: OSV:GHSA-442Q-2J6P-642G...

agency-swarm (>=1.10.0, <=1.10.1), fastapi-code-generator (0.7.0) potentially affected by CVE-2026-55390 via datamodel-code-generator (>=0.59.1, <=0.61.0)

datamodel-code-generator PYPI version =0.59.1, =1.10.0, =1.10.1 - fastapi-code-generator 0.7.0 Source cves: CVE-2026-55390 Source advisory: MEND:CVE-2026-55390...

FastAPI Docs Panel - Detect

FastAPI Docs panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FastAPI Docs panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FastAPI Docs Panel - Detect', 'description': 'FastAPI Doc...