{"items":[{"id":"CVE-2026-114138","published":"2026-10-21T20:09:06.489Z","updated":"2026-10-28T18:11:30.554Z","title":"Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation","severity":"HIGH","score":7.5,"vendor":"encode","product":"django-rest-framework","kev":false,"epss":0.00595,"kevAdded":null,"exploit":true},{"id":"CVE-2026-114137","published":"2026-10-21T20:06:57.790Z","updated":"2026-10-23T15:08:55.473Z","title":"Django REST framework: TokenProxy.delete() reports success and revokes nothing","severity":"HIGH","score":7.4,"vendor":"encode","product":"django-rest-framework","kev":false,"epss":0.00512,"kevAdded":null,"exploit":false},{"id":"CVE-2026-114136","published":"2026-10-21T20:02:41.030Z","updated":"2026-10-30T19:24:46.203Z","title":"Django REST framework: JSONParser applies an attacker-named codec to the request stream","severity":"HIGH","score":7.5,"vendor":"encode","product":"django-rest-framework","kev":false,"epss":0.00503,"kevAdded":null,"exploit":true},{"id":"CVE-2026-73229","published":"2026-08-11T18:59:34.151Z","updated":"2026-08-11T20:06:33.042Z","title":"Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests","severity":"MEDIUM","score":4.3,"vendor":"encode","product":"django-rest-framework","kev":false,"epss":0.00373,"kevAdded":null,"exploit":true},{"id":"CVE-2026-73228","published":"2026-08-11T18:54:16.694Z","updated":"2026-08-13T14:07:46.158Z","title":"Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`","severity":"MEDIUM","score":5.3,"vendor":"encode","product":"django-rest-framework","kev":false,"epss":0.00557,"kevAdded":null,"exploit":true},{"id":"CVE-2025-54121","published":"2025-07-21T20:06:03.818Z","updated":"2025-07-22T19:54:24.784Z","title":"Starlette has possible denial-of-service vector when parsing large files in multipart forms","severity":"MEDIUM","score":5.3,"vendor":"encode","product":"starlette","kev":false,"epss":0.0066,"kevAdded":null,"exploit":true},{"id":"CVE-2024-47874","published":"2024-10-15T15:45:03.555Z","updated":"2024-11-21T16:53:01.345Z","title":"Starlette Denial of service (DoS) via multipart/form-data","severity":"HIGH","score":8.7,"vendor":"encode","product":"starlette","kev":false,"epss":0.00653,"kevAdded":null,"exploit":true},{"id":"CVE-2024-24762","published":"2024-02-05T14:33:06.481Z","updated":"2025-05-09T16:32:50.015Z","title":"python-multipart vulnerable to content-type header Regular expression Denial of Service","severity":"HIGH","score":7.5,"vendor":"Kludex","product":"python-multipart","kev":false,"epss":0.01523,"kevAdded":null,"exploit":true},{"id":"CVE-2023-29159","published":"2023-06-01T00:00:00.000Z","updated":"2025-01-09T19:18:29.375Z","title":"Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web…","severity":"HIGH","score":7.5,"vendor":"Encode","product":"Starlette","kev":false,"epss":0.02593,"kevAdded":null,"exploit":true},{"id":"CVE-2023-30798","published":"2023-04-21T15:27:47.358Z","updated":"2026-07-15T01:24:51.094Z","title":"MultipartParser DOS with too many fields or files in Starlette Framework","severity":"HIGH","score":7.5,"vendor":"Encode","product":"Starlette","kev":false,"epss":0.01299,"kevAdded":null,"exploit":false}]}