Ddjangoproject

Products

Exploited and recent CVEs

• CVE-2026-114582 Medium 5.3 Server-side request forgery via SpatialReference string input 0.4%
• CVE-2026-113733 Low 2.2 Password hash disclosure to "view only" admin users with custom user models 0.4%
• CVE-2026-113593 Low 3.1 Potential exposure of private data via empty and missing Vary headers 0.5%
• CVE-2026-111362 Medium 5.3 Server-side request forgery via crs member of GeoJSON geometries 0.5%
• CVE-2026-111211 Medium 5.3 Potential log injection via unescaped geometry form values 0.5%
• CVE-2026-108147 Medium 5.3 Potential memory exhaustion in MultiPartParser via base64-encoded file upload 0.6%
• CVE-2026-87975 Medium 4.3 Privilege abuse in model formsets with editable primary keys 0.2%
• CVE-2026-87890 Medium 5.3 Potential request forgery via spatial lookup byte values 0.3%
• CVE-2026-84429 Medium 5.3 Potential denial-of-service vulnerability in HTTP header parsing 0.5%
• CVE-2026-77050 Medium 5.3 Potential denial-of-service vulnerability in get_supported_language_variant() 0.5%
• CVE-2026-15920 Medium 6.1 Potential cross-site scripting via URLField values in the admin 0.4%
• CVE-2026-15830 Medium 5.3 Potential denial-of-service vulnerability via nested geometry collections 1.1%
• CVE-2026-15337 Medium 5.3 Potential denial-of-service vulnerability in check_for_language() 0.6%
• CVE-2026-15307 High 8.8 Server-side file-write and request forgery via spatial lookups 1.1%
• CVE-2026-53878 Medium 6.1 Header injection possibility since DomainNameValidator accepted newlines in input 0.3%
• CVE-2026-53877 Medium 4.8 Heap buffer over-read in GDALRaster 0.5%
• CVE-2026-48588 Medium 4.2 Potential exposure of private data via cached Set-Cookie response 0.4%
• CVE-2026-44546 Low 3.7 Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing 0.2%
• CVE-2026-44545 Medium 5.3 Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service 0.3%
• CVE-2026-48587 Low 3.1 Potential exposure of private data via whitespace padding in Vary header 0.4%
• CVE-2026-35193 Low 3.1 Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware 0.4%
• CVE-2026-8404 Low 3.1 Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware 0.3%
• CVE-2026-7666 Low 3.1 Potential unencrypted email transmission via STARTTLS in the SMTP backend 0.1%
• CVE-2026-6873 Low 3.1 Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie 0.2%
• CVE-2026-35192 Low 2.3 Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST 0.5%
• CVE-2026-6907 Medium 4.3 Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware 0.4%
• CVE-2026-5766 Medium 5.3 Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass 0.4%
• CVE-2026-33034 High 7.5 Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass 0.8%
• CVE-2026-33033 Medium 6.5 Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload 0.9%
• CVE-2026-4292 Low 2.7 Privilege abuse in ModelAdmin.list_editable 0.3%