fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-54282 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

ariadne (>=0.15.0.dev4, <=0.15.0.dev5), ariadne-graphql-modules (>=0.2.0.dev1, <=0.2.0.dev2) +8 more potentially affected by CVE-2026-54282 via starlette (0.18.0)

starlette PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - ariadne =0.15.0.dev4, =0.2.0.dev1, =0.1.1, =1.0.0rc4, =1.4.1, =1.4.2 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

fastapi (0.77.0), goe-framework (>=1.0.6.dev0, <=1.1.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.19.0)

starlette PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.77.0 - goe-framework =1.0.6.dev0, =0.2.6, =0.2.8 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

axdocsystem (>=0.1.2, <=0.1.52), columbus (>=0.1.0, <=0.1.9) +10 more potentially affected by CVE-2026-54282 via starlette (0.24.0)

starlette PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - axdocsystem =0.1.2, =0.1.0, =2.0.7, =0.0.31, =0.1.2, =1.0.1rc1, =0.2.4, =5.3.0b1, =5.3.0b2 Source cves: CVE-2026-54282 Source advisory:...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-54282 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

aiocronjob (>=0.1.0, <=0.2.6), as-fastapi-toolbox (0.3.6) +23 more potentially affected by CVE-2026-54282 via starlette (0.13.2)

starlette PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aiocronjob =0.1.0, =0.2.0, =0.12.13, =1.1.0, =0.50.0, =0.2.4, =0.0.1a1, =0.2.4, =0.0.1, =0.7.0, =0.1.0, =0.1.9, =0.2.3 and more Source cves:...

agent-os-py (>=0.0.1, <=0.1.1), agl-ocr-reader (1.1.1) +13 more potentially affected by CVE-2026-54282 via starlette (0.28.0)

starlette PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agent-os-py =0.0.1, =1.0.22, =0.4.4, =2023.8.0b1, =6.1.8, =0.1.25, =0.1.0a3, =0.1.0a11 Source cves: CVE-2026-54282 Source advisory:...

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-54282 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

CVE-2026-49468: Authentication Bypass by Spoofing

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from...

GHSA-JR33-MW75-7J8F dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens Summary The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbtplatformcontext endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt...

SUSE CVE-2026-48818

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account's...

Missing Authentication for Critical Function

Overview hermes-agent is a The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the handling of WebSocket upgrade requests on /api/pty, /api/ws,...

GHSA-4PQM-J46F-795X Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48817 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-22...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48817 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48817 Source advisor...

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-48817 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-48817 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48817 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...

ariadne (>=0.15.0.dev4, <=0.15.0.dev5), ariadne-graphql-modules (>=0.2.0.dev1, <=0.2.0.dev2) +8 more potentially affected by CVE-2026-48817 via starlette (0.18.0)

starlette PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - ariadne =0.15.0.dev4, =0.2.0.dev1, =0.1.1, =1.0.0rc4, =1.4.1, =1.4.2 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...