{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:33.620Z","products":["kludex"],"actNowTotal":1,"results":[{"query":"kludex","matched":1,"actNow":1,"events":[{"id":"kev-2026-09-02-kludex-starlette","url":"https://securitythreatpulse.com/events/kev-2026-09-02-kludex-starlette","title":"Kludex Starlette: attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 159 days old, so current versions are being attacked. Ready-made attack tools are public. The exploit prediction score is 70%.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-48710"],"vendor":"Kludex","product":"Starlette","affectedProducts":[{"vendorKey":"kludex","productKey":"starlette","vendor":"Kludex","product":"Starlette","slug":"kludex/starlette","kind":"direct","evidence":["kev"]}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.","cvss":6.5,"epss":0.70288,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-02","kevDueDate":"2026-09-16","firstSeenAt":"2026-09-02T00:00:00.000Z","updatedAt":"2026-11-01T22:07:41.078Z","newestEvidenceAt":"2026-10-24T23:23:07.997Z"}]}]}