faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

axdocsystem (>=0.1.2, <=0.1.52), columbus (>=0.1.0, <=0.1.9) +10 more potentially affected by CVE-2026-48710 via starlette (0.24.0)

starlette PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - axdocsystem =0.1.2, =0.1.0, =2.0.7, =0.0.31, =0.1.2, =1.0.1rc1, =0.2.4, =5.3.0b1, =5.3.0b2 Source cves: CVE-2026-48710 Source advisory:...

accidental-vulnerability (>=2.0.4, <=2.0.5), fastapi (>=0.1.19, <=0.5.1) potentially affected by CVE-2026-48710 via starlette (0.10.1)

starlette PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - accidental-vulnerability =2.0.4, =0.1.19, =0.5.1 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48710 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48710 Source advisory:...

auditorium (>=19.1.2, <=20.2.1), bbfcapi (>=1.0.0, <=1.0.1) +23 more potentially affected by CVE-2026-48710 via starlette (0.12.9)

starlette PYPI version 0.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - auditorium =19.1.2, =1.0.0, =0.8.0, =0.1.1, =0.0.1, =0.4.0, =0.41.0, =0.1.16, =0.1.29, =0.1.0, =0.0.2, =1.0.0b1, =0.1.1, =0.1.6 and more Sour...

CVE-2026-45554

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside...

CVE-2026-45554: Uncaught Exception

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside...

The vulnerability was concealed in Starlette

There is a vulnerability in Starlette, a Python library for developing web services. Starlette is used by various products, including FastAPI. An unauthorized malicious actor can exploit this vulnerability to bypass authentication checks. This allows the malicious actor to access protected URL...

Exploit for CVE-2026-48710

BadHost — CVE-2026-48710 Scanner Detection-only scanner for t...

Malicious code in fastapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a753fd569a7bb908b7cdf82fe0228dc0e24dcc253b67993af5dd5c30b61f4411 This release of fastapi 0.136.3 modifies pyproject.toml and PKG-INFO to add an undocumented dependency 'fastar=0.9.0' to the...

MAL-2026-4750 Malicious code in fastapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a753fd569a7bb908b7cdf82fe0228dc0e24dcc253b67993af5dd5c30b61f4411 This release of fastapi 0.136.3 modifies pyproject.toml and PKG-INFO to add an undocumented dependency 'fastar=0.9.0' to the...

faastapi (>=0.1.2, <=0.3.4), fastapi (>=0.23.0, <=0.33.0) +1 more potentially affected by CVE-2026-48710 via starlette (0.12.0)

starlette PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - faastapi =0.1.2, =0.23.0, =0.33.0 - strawberry-graphql 0.12.0 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

balto (>=0.1.5, <=0.3.0), fastapi (>=0.34.0, <=0.37.0) +3 more potentially affected by CVE-2026-48710 via starlette (0.12.7)

starlette PYPI version 0.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - balto =0.1.5, =0.34.0, =0.1.7, =0.14.0, =0.14.3 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

fastapi (0.1.18) potentially affected by CVE-2026-48710 via starlette (0.9.10)

starlette PYPI version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.1.18 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-48710 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-48710 Source advisor...

dms (0.0.1), fastapi (>=0.38.0, <=0.40.0) +6 more potentially affected by CVE-2026-48710 via starlette (0.12.8)

starlette PYPI version 0.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dms 0.0.1 - fastapi =0.38.0, =0.1.24, =5.4.0, =0.1.0, =0.0.1, =0.14.4, =0.15.0 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-16...

async-easy-utils (>=0.0.1, <=0.1.3), busylight-for-humans (>=0.4.0, <=0.4.3) +22 more potentially affected by CVE-2026-48710 via starlette (0.13.4)

starlette PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - async-easy-utils =0.0.1, =0.4.0, =0.1.0, =0.57.0, =2.0.0, =1.0.1, =1.0.0b50, =0.1.0, =0.1.0, =0.1.16, =0.0.1.dev1, =2.0.0a1, =0.1.5, =0.1.7 a...

accidental-vulnerability (>=2.0.4, <=2.0.5), fastapi (>=0.1.19, <=0.5.1) potentially affected by CVE-2026-48710 via starlette (0.10.1)

starlette PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - accidental-vulnerability =2.0.4, =0.1.19, =0.5.1 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

fastapi (>=0.6.0, <=0.22.0) potentially affected by CVE-2026-48710 via starlette (0.11.1)

starlette PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi =0.6.0, =0.22.0 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

BIT-MLFLOW-2026-2652 Authentication Bypass in mlflow/mlflow

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...