CVE-2026-53869: Missing Authentication for Critical Function

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling...

CVE-2026-48817: Use of Externally-Controlled Input to Select Classes or Code

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an...

definitive-openassistants (>=0.0.1, <=0.0.7), definitive-openassistants-fastapi (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.346)

langchain PYPI version 0.0.346 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - definitive-openassistants =0.0.1, =0.0.1, =1.7.0, =1.7.0, =2.7.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

beeai-cli (>=0.3.0rc4, <=0.3.4rc1), catweazle (>=1.0.0, <=1.0.2) +16 more potentially affected by CVE-2026-54282 via starlette (0.47.2)

starlette PYPI version 0.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - beeai-cli =0.3.0rc4, =1.0.0, =2.6.1, =1.3.0, =2.37.0, =1.2.5, =1.0.0, =0.12.4, =0.0.1, =1.0.0, =0.1.0, =0.1.34 and more Source cves:...

fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-54282 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-54282 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-54282 Source advisory:...

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-54282 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

async-easy-utils (>=0.0.1, <=0.1.3), busylight-for-humans (>=0.4.0, <=0.4.3) +22 more potentially affected by CVE-2026-54282 via starlette (0.13.4)

starlette PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - async-easy-utils =0.0.1, =0.4.0, =0.1.0, =0.57.0, =2.0.0, =1.0.1, =1.0.0b50, =0.1.0, =0.1.0, =0.1.16, =0.0.1.dev1, =2.0.0a1, =0.1.5, =0.1.7 a...

fastapi (0.1.18) potentially affected by CVE-2026-54282 via starlette (0.9.10)

starlette PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.1.18 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-54282 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-54282 Source advisor...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +894 more potentially affected by CVE-2026-54282 via starlette (0.46.2)

starlette PYPI version 0.46.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aa-rag =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and mor...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-54282 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

accidental-vulnerability (>=2.0.4, <=2.0.5), fastapi (>=0.1.19, <=0.5.1) potentially affected by CVE-2026-54282 via starlette (0.10.1)

starlette PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - accidental-vulnerability =2.0.4, =0.1.19, =0.5.1 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

fastapi (0.77.0), goe-framework (>=1.0.6.dev0, <=1.1.0) +1 more potentially affected by CVE-2026-54282 via starlette (0.19.0)

starlette PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.77.0 - goe-framework =1.0.6.dev0, =0.2.6, =0.2.8 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

GHSA-6JV3-5F52-599M python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

Summary QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse since the CVE-2021-23336 fix treat only & as a separator. This creates a parser differential: the same bytes...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48818 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48818 Source advisory: OSV:GHSA-WQP7-X3PW-XC5R...

axdocsystem (>=0.1.2, <=0.1.52), columbus (>=0.1.0, <=0.1.9) +10 more potentially affected by CVE-2026-48818 via starlette (0.24.0)

starlette PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - axdocsystem =0.1.2, =0.1.0, =2.0.7, =0.0.31, =0.1.2, =1.0.1rc1, =0.2.4, =5.3.0b1, =5.3.0b2 Source cves: CVE-2026-48818 Source advisory:...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48818 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48818 Source advisor...

fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-48818 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-48818 Source advisory: OSV:GHSA-WQP7-X3PW-XC5R...