CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Starlette Security Middleware Bypass via Insufficient HTTP Host Header Validation (CVE-2026-48710)
[Affected Scope] All web applications utilizing Starlette ASGI framework prior to version 1.0.1
[Impact] Malformed Host headers can cause a discrepancy between the actual routed path and request.url.path, allowing attackers to bypass URL-based security middleware and access controls
[Mitigation] Immediately upgrade the Starlette package to version 1.0.1 or higher
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network
[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117
Fortinet FortiOS Sensitive Information Exposure and Symbolic Link Patch Bypass (CVE-2025-68686)
[Affected Scope] Fortinet FortiOS versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of 7.2, 7.0, and 6.4
[Impact] A remote unauthenticated attacker with prior filesystem-level access can bypass existing symbolic link persistency mitigations via crafted HTTP requests to expose sensitive information
[Mitigation] Immediately upgrade to the patched firmware versions recommended in the official Fortinet advisory (FG-IR-25-934)