https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:15:20.118128+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25478 CVE-2026-25478 — Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins 2026-10-06T20:15:20.172083+00:00

Affected: litestar-org litestar

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.

 https://cve.radiocsirt.org/vuln/pysec-2026-2195 PYSEC-2026-2195 2026-10-06T20:15:20.172165+00:00

Affected: PyPI: litestar

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, CORSConfig.allowed_origins_regex is constructed using a regex built from configured allowlist values and used with fullmatch() for validation. Because metacharacters are not escaped, a malicious origin can match unexpectedly. The check relies on allowed_origins_regex.fullmatch(origin). This vulnerability is fixed in 2.20.0.