djangoproject Django

• CVE-2026-114582 Medium 5.3 Server-side request forgery via SpatialReference string input 0.4%
• CVE-2026-113733 Low 2.2 Password hash disclosure to "view only" admin users with custom user models 0.4%
• CVE-2026-113593 Low 3.1 Potential exposure of private data via empty and missing Vary headers 0.5%
• CVE-2026-111362 Medium 5.3 Server-side request forgery via crs member of GeoJSON geometries 0.5%
• CVE-2026-111211 Medium 5.3 Potential log injection via unescaped geometry form values 0.5%
• CVE-2026-108147 Medium 5.3 Potential memory exhaustion in MultiPartParser via base64-encoded file upload 0.6%
• CVE-2026-87975 Medium 4.3 Privilege abuse in model formsets with editable primary keys 0.2%
• CVE-2026-87890 Medium 5.3 Potential request forgery via spatial lookup byte values 0.3%
• CVE-2026-84429 Medium 5.3 Potential denial-of-service vulnerability in HTTP header parsing 0.5%
• CVE-2026-77050 Medium 5.3 Potential denial-of-service vulnerability in get_supported_language_variant() 0.5%
• CVE-2026-15920 Medium 6.1 Potential cross-site scripting via URLField values in the admin 0.4%
• CVE-2026-15830 Medium 5.3 Potential denial-of-service vulnerability via nested geometry collections 1.1%
• CVE-2026-15337 Medium 5.3 Potential denial-of-service vulnerability in check_for_language() 0.6%
• CVE-2026-15307 High 8.8 Server-side file-write and request forgery via spatial lookups 1.1%
• CVE-2026-53878 Medium 6.1 Header injection possibility since DomainNameValidator accepted newlines in input 0.3%
• CVE-2026-53877 Medium 4.8 Heap buffer over-read in GDALRaster 0.5%
• CVE-2026-48588 Medium 4.2 Potential exposure of private data via cached Set-Cookie response 0.4%
• CVE-2026-48587 Low 3.1 Potential exposure of private data via whitespace padding in Vary header 0.4%
• CVE-2026-35193 Low 3.1 Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware 0.4%
• CVE-2026-8404 Low 3.1 Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware 0.3%
• CVE-2026-7666 Low 3.1 Potential unencrypted email transmission via STARTTLS in the SMTP backend 0.1%
• CVE-2026-6873 Low 3.1 Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie 0.2%
• CVE-2026-35192 Low 2.3 Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST 0.5%
• CVE-2026-6907 Medium 4.3 Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware 0.4%
• CVE-2026-5766 Medium 5.3 Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass 0.4%
• CVE-2026-33034 High 7.5 Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass 0.8%
• CVE-2026-33033 Medium 6.5 Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload 0.9%
• CVE-2026-4292 Low 2.7 Privilege abuse in ModelAdmin.list_editable 0.3%
• CVE-2026-4277 Critical 9.8 Privilege abuse in GenericInlineModelAdmin 0.5%
• CVE-2026-3902 High 7.5 ASGI header spoofing via underscore/hyphen conflation 0.4%
• CVE-2026-25674 Low 3.7 Potential incorrect permissions on newly created file system objects 0.4%
• CVE-2026-25673 High 7.5 Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows 0.8%
• CVE-2025-14550 High 7.5 Potential denial-of-service vulnerability via repeated headers when using ASGI 1.1%
• CVE-2026-1312 Medium 5.4 Potential SQL injection via QuerySet.order_by and FilteredRelation 0.9%
• CVE-2026-1287 Medium 5.4 Potential SQL injection in column aliases via control characters 0.8%
• CVE-2026-1285 High 7.5 Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods 1.1%
• CVE-2026-1207 Medium 5.4 Potential SQL injection via raster lookups on PostGIS 12.8%
• CVE-2025-13473 Medium 5.3 Username enumeration through timing difference in mod_wsgi authentication handler 0.8%
• CVE-2025-64460 High 7.5 Potential denial-of-service vulnerability in XML serializer text extraction 2.2%
• CVE-2025-13372 Medium 4.3 Potential SQL injection in FilteredRelation column aliases on PostgreSQL 0.9%
• CVE-2025-64459 Critical 9.1 Potential SQL injection via _connector keyword argument in QuerySet and Q objects 19.3%
• CVE-2025-64458 High 7.5 Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows 1.9%
• CVE-2025-59682 Low 3.1 An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --templat 0.9%
• CVE-2025-59681 High 7.1 An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injec 0.6%
• CVE-2025-57833 High 7.1 An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with 28.3%
• CVE-2025-48432 Medium 4.0 An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially 0.8%
• CVE-2025-32873 Medium 5.3 An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performanc 14.3%
• CVE-2025-27556 Medium 5.8 An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.views.LoginView, django.contrib.auth.views.Lo 1.1%
• CVE-2025-26699 Medium 5.0 An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-serv 0.8%
• CVE-2024-56374 Medium 5.8 An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a po 1.3%