[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-35536":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":19,"aliases":20,"duplicate_of":9,"upstream":25,"downstream":26,"duplicates":55,"related":56,"reserved_at":9,"published_at":61,"modified_at":62,"state":63,"summary":64,"references_raw":73,"kevs":105,"epss":106,"epss_history":109,"metrics":382,"affected":396},"CVE-2026-35536","In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-159","Improper Handling of Invalid Use of Special Elements","The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.","weakness","Draft","Class",[],[],[21,22,23,24],"GHSA-fqwm-6jpj-5wxc","ECHO-b644-e810-f4a8","GHSA-78cv-mqj4-43f7","PYSEC-2026-2287",[],[27,29,31,33,35,37,39,41,43,45,47,49,51,53],{"_key":28},"USN-8198-1",{"_key":30},"USN-8198-2",{"_key":32},"UBUNTU-CVE-2026-35536",{"_key":34},"DEBIAN-CVE-2026-35536",{"_key":36},"MGASA-2026-0216",{"_key":38},"RHSA-2026:13641",{"_key":40},"RHSA-2026:13670",{"_key":42},"RHSA-2026:19034",{"_key":44},"RHSA-2026:19189",{"_key":46},"RHSA-2026:20572",{"_key":48},"RHSA-2026:20573",{"_key":50},"RHSA-2026:20577",{"_key":52},"RHSA-2026:20810",{"_key":54},"RHSA-2026:24342",[],[57,59],{"_key":58},"CGA-FHQ4-732H-4F38",{"_key":60},"CGA-WGRM-6H3R-2PWR","2026-04-03T02:25:57.427Z","2026-04-03T13:12:16.105Z","Analyzed",{"cisa_kev":65,"cisa_ransomware":65,"cisa_vendor":9,"epss_severity":66,"epss_score":67,"severity":68,"severity_score":69,"severity_version":70,"severity_source":71,"severity_vector":72,"severity_status":63},false,"low",0.00237,"high",7.2,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",[74,83,88,92,97,101],{"url":75,"sources":76,"tags":79},"https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7",[71,77,78],"nvd","osv_pypi",[80,81,82],"WEB","Vendor Advisory","Advisory",{"url":84,"sources":85,"tags":86},"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5",[71,77,78],[80,87],"Product",{"url":89,"sources":90,"tags":91},"https://nvd.nist.gov/vuln/detail/CVE-2026-35536",[78],[82],{"url":93,"sources":94,"tags":95},"https://github.com/tornadoweb/tornado",[78],[96],"PACKAGE",{"url":98,"sources":99,"tags":100},"https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104",[78],[80],{"url":102,"sources":103,"tags":104},"https://github.com/advisories/GHSA-fqwm-6jpj-5wxc",[78],[82],[],{"date":107,"score":67,"percentile":108},"2026-07-05",0.14612,[110,114,117,120,123,125,128,132,135,139,142,145,148,151,154,157,160,163,166,169,172,175,178,181,184,186,189,192,195,198,200,203,206,210,213,216,219,222,225,228,231,234,237,240,243,246,249,252,255,258,262,265,268,271,274,277,280,283,286,289,292,295,298,301,304,307,309,312,315,319,322,325,328,331,334,337,340,343,346,349,352,355,358,361,364,367,370,373,376,379],{"date":111,"score":112,"percentile":113},"2026-04-03",0.00037,0.11026,{"date":115,"score":112,"percentile":116},"2026-04-04",0.11065,{"date":118,"score":112,"percentile":119},"2026-04-05",0.11052,{"date":121,"score":112,"percentile":122},"2026-04-06",0.10888,{"date":124,"score":112,"percentile":122},"2026-04-07",{"date":126,"score":112,"percentile":127},"2026-04-08",0.10964,{"date":129,"score":130,"percentile":131},"2026-04-09",0.00048,0.15021,{"date":133,"score":130,"percentile":134},"2026-04-10",0.15025,{"date":136,"score":137,"percentile":138},"2026-04-11",0.00051,0.15913,{"date":140,"score":137,"percentile":141},"2026-04-12",0.15874,{"date":143,"score":137,"percentile":144},"2026-04-13",0.15806,{"date":146,"score":137,"percentile":147},"2026-04-14",0.15717,{"date":149,"score":137,"percentile":150},"2026-04-15",0.15751,{"date":152,"score":137,"percentile":153},"2026-04-16",0.15728,{"date":155,"score":137,"percentile":156},"2026-04-17",0.15729,{"date":158,"score":137,"percentile":159},"2026-04-18",0.15738,{"date":161,"score":137,"percentile":162},"2026-04-19",0.15681,{"date":164,"score":137,"percentile":165},"2026-04-20",0.15674,{"date":167,"score":137,"percentile":168},"2026-04-21",0.15781,{"date":170,"score":137,"percentile":171},"2026-04-22",0.15845,{"date":173,"score":137,"percentile":174},"2026-04-23",0.15849,{"date":176,"score":137,"percentile":177},"2026-04-24",0.15799,{"date":179,"score":137,"percentile":180},"2026-04-25",0.15812,{"date":182,"score":137,"percentile":183},"2026-04-26",0.15796,{"date":185,"score":137,"percentile":168},"2026-04-27",{"date":187,"score":137,"percentile":188},"2026-04-28",0.15752,{"date":190,"score":137,"percentile":191},"2026-04-29",0.15753,{"date":193,"score":137,"percentile":194},"2026-04-30",0.15722,{"date":196,"score":137,"percentile":197},"2026-05-01",0.15702,{"date":199,"score":137,"percentile":194},"2026-05-02",{"date":201,"score":137,"percentile":202},"2026-05-03",0.15699,{"date":204,"score":137,"percentile":205},"2026-05-04",0.15634,{"date":207,"score":208,"percentile":209},"2026-05-05",0.00056,0.17086,{"date":211,"score":208,"percentile":212},"2026-05-06",0.17078,{"date":214,"score":208,"percentile":215},"2026-05-07",0.17175,{"date":217,"score":208,"percentile":218},"2026-05-08",0.17197,{"date":220,"score":208,"percentile":221},"2026-05-09",0.17268,{"date":223,"score":208,"percentile":224},"2026-05-10",0.1726,{"date":226,"score":208,"percentile":227},"2026-05-11",0.17237,{"date":229,"score":208,"percentile":230},"2026-05-12",0.17277,{"date":232,"score":208,"percentile":233},"2026-05-13",0.17319,{"date":235,"score":208,"percentile":236},"2026-05-14",0.17359,{"date":238,"score":208,"percentile":239},"2026-05-15",0.17354,{"date":241,"score":208,"percentile":242},"2026-05-16",0.17366,{"date":244,"score":208,"percentile":245},"2026-05-17",0.17344,{"date":247,"score":208,"percentile":248},"2026-05-18",0.173,{"date":250,"score":208,"percentile":251},"2026-05-19",0.17281,{"date":253,"score":208,"percentile":254},"2026-05-20",0.17297,{"date":256,"score":208,"percentile":257},"2026-05-21",0.17285,{"date":259,"score":260,"percentile":261},"2026-05-22",0.00018,0.04963,{"date":263,"score":260,"percentile":264},"2026-05-23",0.04951,{"date":266,"score":260,"percentile":267},"2026-05-24",0.04956,{"date":269,"score":260,"percentile":270},"2026-05-25",0.04944,{"date":272,"score":260,"percentile":273},"2026-05-26",0.04941,{"date":275,"score":260,"percentile":276},"2026-05-27",0.04969,{"date":278,"score":260,"percentile":279},"2026-05-28",0.04986,{"date":281,"score":260,"percentile":282},"2026-05-29",0.04998,{"date":284,"score":260,"percentile":285},"2026-05-30",0.05011,{"date":287,"score":260,"percentile":288},"2026-05-31",0.04992,{"date":290,"score":260,"percentile":291},"2026-06-01",0.04928,{"date":293,"score":260,"percentile":294},"2026-06-02",0.04886,{"date":296,"score":260,"percentile":297},"2026-06-03",0.04859,{"date":299,"score":260,"percentile":300},"2026-06-04",0.04849,{"date":302,"score":260,"percentile":303},"2026-06-05",0.04868,{"date":305,"score":260,"percentile":306},"2026-06-06",0.04857,{"date":308,"score":260,"percentile":300},"2026-06-07",{"date":310,"score":260,"percentile":311},"2026-06-08",0.04811,{"date":313,"score":260,"percentile":314},"2026-06-09",0.0484,{"date":316,"score":317,"percentile":318},"2026-06-10",0.00019,0.05232,{"date":320,"score":317,"percentile":321},"2026-06-11",0.05255,{"date":323,"score":317,"percentile":324},"2026-06-12",0.0527,{"date":326,"score":317,"percentile":327},"2026-06-13",0.05263,{"date":329,"score":317,"percentile":330},"2026-06-14",0.05254,{"date":332,"score":67,"percentile":333},"2026-06-15",0.14428,{"date":335,"score":67,"percentile":336},"2026-06-16",0.14449,{"date":338,"score":67,"percentile":339},"2026-06-17",0.14444,{"date":341,"score":67,"percentile":342},"2026-06-18",0.14451,{"date":344,"score":67,"percentile":345},"2026-06-19",0.1444,{"date":347,"score":67,"percentile":348},"2026-06-20",0.14432,{"date":350,"score":67,"percentile":351},"2026-06-21",0.1442,{"date":353,"score":67,"percentile":354},"2026-06-22",0.14409,{"date":356,"score":67,"percentile":357},"2026-06-23",0.14438,{"date":359,"score":67,"percentile":360},"2026-06-24",0.14452,{"date":362,"score":67,"percentile":363},"2026-06-25",0.14543,{"date":365,"score":67,"percentile":366},"2026-06-26",0.14561,{"date":368,"score":67,"percentile":369},"2026-06-27",0.14597,{"date":371,"score":67,"percentile":372},"2026-06-28",0.14567,{"date":374,"score":67,"percentile":375},"2026-06-29",0.14562,{"date":377,"score":67,"percentile":378},"2026-06-30",0.14564,{"date":380,"score":67,"percentile":381},"2026-07-01",0.14646,[383,388,394],{"source":71,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":384,"cvss_v4_0":9},{"baseScore":69,"baseSeverity":385,"vectorString":72,"impactScore":386,"exploitabilityScore":387},"HIGH",4.5,10,{"source":77,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":389,"cvss_v4_0":9},{"baseScore":390,"baseSeverity":391,"vectorString":392,"impactScore":393,"exploitabilityScore":387},5.3,"MEDIUM","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",2.3,{"source":78,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":395,"cvss_v4_0":9},{"baseScore":390,"baseSeverity":9,"vectorString":392,"impactScore":393,"exploitabilityScore":387},[397,408],{"ecosystem":398,"name":399,"vendor":398,"product":399,"cpe_part":9,"purl_type":400,"purl_namespace":9,"purl_name":399,"source":9,"versions":401},"PyPI","tornado","pypi",[402],{"version":403,"is_range":404,"range_type":405,"version_start":9,"version_start_type":9,"version_end":406,"version_end_type":407,"fixed_in":9},"lt6_5_5",true,"ecosystem","6.5.5","excluding",{"ecosystem":9,"name":399,"vendor":409,"product":399,"cpe_part":410,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":411},"tornadoweb","a",[412],{"version":413,"is_range":404,"range_type":414,"version_start":9,"version_start_type":9,"version_end":406,"version_end_type":407,"fixed_in":9},"lt6.5.5","cpe"]