TI-2026-36072 CVE-2026-48802 · GHSA-cgwc-pv48-fhj5
python-engineio has unbound thread allocation that can cause denial of service
Priority MEDIUM 40
python-engineio is a Python implementation of the Engine.IO realtime client and server.
miguelgrinberg
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
miguelgrinberg records in CISA KEVNo miguelgrinberg vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-36078 CVE-2026-48809 · GHSA-m9gh-vj53-gvh9
python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
Priority LOW 39
python-engineio is a Python implementation of the Engine.IO realtime client and server.
TI-2026-36073 CVE-2026-48804 · GHSA-5w7q-77mv-v69f
python-socketio: Binary attachment accumulation can cause denial of service
Priority LOW 39
python-socketio is a Python implementation of the Socket.IO realtime client and server.
TI-2026-26780 CVE-2026-34531 · GHSA-p44q-vqpr-4xmg
Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client
Priority LOW 36
Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes.
TI-2025-38159 CVE-2025-61765 · GHSA-g8c6-8fjj-2r4m
Deserialization of untrusted data in miguelgrinberg python-socketio
Priority LOW 31
python-socketio is a Python implementation of the Socket.IO realtime client and server.
TI-2026-31080 CVE-2026-42874 · GHSA-7wc8-wvc4-m498
Microdot: HTTP response splitting in Response.set_cookie()
Priority LOW 17
Microdot is a minimalistic Python web framework.