{"id":"CVE-2026-4292","aliases":["ALPINE-CVE-2026-4292","BIT-django-2026-4292","CLSA-2026-1787220072","CLSA-2026-1793609074","CLSA-2026-1793611298","CLSA-2026-1793695167","CLSA-2026-1793696695","CLSA-2026-1793868799","DEBIAN-CVE-2026-4292","EUVD-2026-19688","GHSA-mmwr-2jhp-mc7j","MGASA-2026-0093","OESA-2026-2216","OESA-2026-2217","OESA-2026-2218","OESA-2026-2219","OESA-2026-2220","PYSEC-2026-53","SUSE-SU-2026:1740-1","UBUNTU-CVE-2026-4292","USN-8154-1","openSUSE-SU-2026:10516-1","openSUSE-SU-2026:10517-1","openSUSE-SU-2026:10567-1","openSUSE-SU-2026:11270-1","openSUSE-SU-2026:20578-1"],"status":"published","title":"Privilege abuse in ModelAdmin.list_editable","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00305,"percentile":0.23449,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-04-07T14:00:00Z","modified":"2026-11-05T13:15:16Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["6.0.4","5.2.13","4.2.30"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["4.2.30-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["5.2.13-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["4.2.30","5.2.13","6.0.4"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"django","fixed_in":["4.2.post6+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:4.2.30-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","fixed_in":["1.6.11-0ubuntu1.3+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.15+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.21+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.29+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-django","fixed_in":["2:3.2.12-2ubuntu1.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-django","fixed_in":["3:5.2.4-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"6.0.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2"},{"fixed":"5.2.13"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.30"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.13-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.2.30"},{"introduced":"5.2.0"},{"fixed":"5.2.13"},{"introduced":"6.0.0"},{"fixed":"6.0.4"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post6+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.10"},{"fixed":"5.1.10.post8+tuxcare"}]}],"versions":["5.1.10","5.1.10.post1+tuxcare","5.1.10.post2+tuxcare","5.1.10.post3+tuxcare","5.1.10.post4+tuxcare","5.1.10.post5+tuxcare","5.1.10.post6+tuxcare","5.1.10.post7+tuxcare"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.post26+tuxcare"}]}],"versions":["4.0","4.0.post1+tuxcare","4.0.post10+tuxcare","4.0.post11+tuxcare","4.0.post12+tuxcare","4.0.post13+tuxcare","4.0.post14+tuxcare","4.0.post15+tuxcare","4.0.post16+tuxcare","4.0.post17+tuxcare","4.0.post18+tuxcare","4.0.post19+tuxcare","4.0.post2+tuxcare","4.0.post20+tuxcare","4.0.post21+tuxcare","4.0.post22+tuxcare","4.0.post23+tuxcare","4.0.post24+tuxcare","4.0.post25+tuxcare","4.0.post3+tuxcare","4.0.post4+tuxcare","4.0.post5+tuxcare","4.0.post6+tuxcare","4.0.post7+tuxcare","4.0.post8+tuxcare","4.0.post9+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9"},{"fixed":"5.1.9.post10+tuxcare"}]}],"versions":["5.1.9","5.1.9.post1+tuxcare","5.1.9.post2+tuxcare","5.1.9.post3+tuxcare","5.1.9.post4+tuxcare","5.1.9.post5+tuxcare","5.1.9.post6+tuxcare","5.1.9.post7+tuxcare","5.1.9.post8+tuxcare","5.1.9.post9+tuxcare"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.25"},{"fixed":"3.2.25.post14+tuxcare"}]}],"versions":["3.2.25","3.2.25.post1+tuxcare","3.2.25.post10+tuxcare","3.2.25.post11+tuxcare","3.2.25.post12+tuxcare","3.2.25.post13+tuxcare","3.2.25.post2+tuxcare","3.2.25.post3+tuxcare","3.2.25.post4+tuxcare","3.2.25.post5+tuxcare","3.2.25.post6+tuxcare","3.2.25.post7+tuxcare","3.2.25.post8+tuxcare","3.2.25.post9+tuxcare"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4"},{"fixed":"5.1.4.post11+tuxcare"}]}],"versions":["5.1.4","5.1.4.post1+tuxcare","5.1.4.post10+tuxcare","5.1.4.post2+tuxcare","5.1.4.post3+tuxcare","5.1.4.post4+tuxcare","5.1.4.post5+tuxcare","5.1.4.post6+tuxcare","5.1.4.post7+tuxcare","5.1.4.post8+tuxcare","5.1.4.post9+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1","3:3.2.25-0+deb12u1","3:3.2.25-0+deb12u2","3:3.2.25-0+deb12u3","3:3.2.25-0+deb12u4","3:3.2.25-0+deb12u5","3:3.2.25-0+deb12u6","3:4.1-1","3:4.1.1-1","3:4.1.2-1","3:4.1.3-1","3:4.1.4-1","3:4.1.5-1","3:4.2-1","3:4.2.1-1","3:4.2.10-1","3:4.2.11-1","3:4.2.13-1","3:4.2.14-1","3:4.2.15-1","3:4.2.15-1~bpo12+1","3:4.2.16-1","3:4.2.17-1","3:4.2.17-2","3:4.2.18-1","3:4.2.18-1~bpo12+1","3:4.2.19-1","3:4.2.19-1~bpo12+1","3:4.2.2-1","3:4.2.20-1","3:4.2.20-1~bpo12+1","3:4.2.21-1","3:4.2.21-1~bpo12+1","3:4.2.22-1","3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.3-1","3:4.2.30-1","3:4.2.4-1","3:4.2.5-1","3:4.2.5-2","3:4.2.6-1","3:4.2.8-1","3:4.2.9-1","3:4.2~alpha1-1","3:4.2~beta1-1","3:4.2~rc1-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.17-2~bpo13+1","3:5.2.18-1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1.1-1","3:6.1.2-1","3:6.1~beta1-1","3:6.1~rc1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-0+deb13u1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-0+deb13u1","3:4.2.28-0+deb13u2","3:4.2.28-1","3:4.2.29-1","3:4.2.30-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.17-2~bpo13+1","3:5.2.18-1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1.1-1","3:6.1.2-1","3:6.1~beta1-1","3:6.1~rc1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.30-1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"fixed":"6.0.4"}]}],"versions":["6.0","6.0.1","6.0.2","6.0.3"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2"},{"fixed":"5.2.13"}]}],"versions":["5.2","5.2.1","5.2.10","5.2.11","5.2.12","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.30"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.25","4.2.26","4.2.27","4.2.28","4.2.29","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13-1.12.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-22.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-15.oe2203sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-15.oe2403"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-15.oe2403sp1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-15.oe2403sp3"}]}],"bundled":8},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.30"},{"introduced":"5.2"},{"fixed":"5.2.13"},{"introduced":"6.0"},{"fixed":"6.0.4"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.25","4.2.26","4.2.27","4.2.28","4.2.29","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.2","5.2.1","5.2.10","5.2.11","5.2.12","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","6.0","6.0.1","6.0.2","6.0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm11"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm12"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10","1.8.7-1ubuntu5.15+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm15"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13","1:1.11.11-1ubuntu1.21+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm8"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6","2:2.2.12-1ubuntu0.29+esm7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.26"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24","2:3.2.12-2ubuntu1.25"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.15"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13","3:4.2.11-1ubuntu1.14"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.4-1ubuntu2.4"}]}],"versions":["3:4.2.18-1ubuntu1","3:4.2.18-1ubuntu1.1","3:5.2.4-1","3:5.2.4-1ubuntu1","3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu2.1","3:5.2.4-1ubuntu2.2","3:5.2.4-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm15"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13","1:1.11.11-1ubuntu1.21+esm14"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm8"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6","2:2.2.12-1ubuntu0.29+esm7"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.26"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24","2:3.2.12-2ubuntu1.25"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.15"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13","3:4.2.11-1ubuntu1.14"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.4-1ubuntu2.4"}]}],"versions":["3:4.2.18-1ubuntu1","3:4.2.18-1ubuntu1.1","3:5.2.4-1","3:5.2.4-1ubuntu1","3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu2.1","3:5.2.4-1ubuntu2.2","3:5.2.4-1ubuntu2.3"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.4-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.13-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-bp160.7.1"}]}],"bundled":5}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["vendor-advisory","Patch","Vendor Advisory","advisory","fix"]},{"url":"https://groups.google.com/g/django-announce","tags":["mailing-list","Release Notes","article","web","advisory"]},{"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","tags":["vendor-advisory","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4292","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-53.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mmwr-2jhp-mc7j","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-4292","tags":["advisory"]},{"url":"https://github.com/django/django/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4292.json","tags":["advisory"]},{"url":"https://pypi.org/project/Django/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-4292","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0093.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35330","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/07/10","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4277","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5766","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6907","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2218","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2219","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2220","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261740-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261722","tags":["report"]},{"url":"https://bugzilla.suse.com/1261724","tags":["report"]},{"url":"https://bugzilla.suse.com/1261729","tags":["report"]},{"url":"https://bugzilla.suse.com/1261731","tags":["report"]},{"url":"https://bugzilla.suse.com/1261732","tags":["report"]},{"url":"https://bugzilla.suse.com/1264152","tags":["report"]},{"url":"https://bugzilla.suse.com/1264153","tags":["report"]},{"url":"https://bugzilla.suse.com/1264154","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-4292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4292","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8154-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8154-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-3902","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4277","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33034","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-4292","title":"Privilege abuse in ModelAdmin.list_editable","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T14:22:38.254Z","modified":"2026-04-07T15:12:56.065Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-19688","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T14:22:38Z","modified":"2026-04-07T15:12:56Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:25:12.908169Z"}],"ghsa":[{"id":"GHSA-mmwr-2jhp-mc7j","title":"Django vulnerable to privilege abuse in ModelAdmin.list_editable","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data.\n\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T15:30:52Z","modified":"2026-06-06T00:26:29Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2026-4292","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T15:17:46.65Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"ALPINE-CVE-2026-4292","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T15:17:46.65Z","modified":"2026-11-03T06:33:02.962554536Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-4292","title":"Privilege abuse in ModelAdmin.list_editable","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T14:22:38.254Z","modified":"2026-10-28T02:30:48.137642807Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-4292","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T15:17:46.65Z","modified":"2026-10-27T10:01:29.738761827Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"GHSA-mmwr-2jhp-mc7j","title":"Django vulnerable to privilege abuse in ModelAdmin.list_editable","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data.\n\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T15:30:52Z","modified":"2026-09-10T03:50:44.924686158Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2026-2216","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread\u0026apos;s temporary `umask` change affects other threads in multi-threaded environments. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-25674)\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)\n\nAn issue was discovered in Django\u0026apos;s GenericInlineModelAdmin component. Add permissions on inline model instances were not validated on submission of forged POST data. This vulnerability affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.(CVE-2026-4277)\n\nAn issue was discovered in Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.(CVE-2026-4292)","status":"published","published":"2026-05-09T11:11:11Z","modified":"2026-08-18T01:19:51.665063292Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2217","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)\n\nThis issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie\u0026amp;#39;s response header does not change, but \u0026amp;quot;SESSION_SAVE_EVERY_REQUEST\u0026amp;quot; is \u0026amp;quot;true\u0026amp;quot;. A remote attacker could steal a user\u0026amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not been evaluated and may also be affected. Django thanks Cantina for reporting this issue.(CVE-2026-35192)\n\nAn issue was discovered in Django versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-3902)\n\nAn issue was discovered in Django\u0026apos;s GenericInlineModelAdmin component. Add permissions on inline model instances were not validated on submission of forged POST data. This vulnerability affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.(CVE-2026-4277)\n\nAn issue was discovered in Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.(CVE-2026-4292)\n\nWhen processing ASGI requests, if the Content-Length request header is deliberately omitted in a malicious request, or a false value is provided that is much smaller than the actual file, the system will be deceived, thereby bypassing Django\u0026apos;s built-in FILE_UPLOAD_MAX_MEMORY_SIZE (maximum memory file upload limit)(CVE-2026-5766)\n\n处理 ASGI 请求时，如果请求中缺少 Content-Length 请求头，或者人为提供了偏小的数值，就能绕过 Django 内置的 FILE_UPLOAD_MAX_MEMORY_SIZE（最大内存文件上传大小）限制(CVE-2026-6907)","status":"published","published":"2026-05-09T11:11:12Z","modified":"2026-08-18T01:19:51.881959696Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2218","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)\n\nThis issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie\u0026amp;#39;s response header does not change, but \u0026amp;quot;SESSION_SAVE_EVERY_REQUEST\u0026amp;quot; is \u0026amp;quot;true\u0026amp;quot;. A remote attacker could steal a user\u0026amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not been evaluated and may also be affected. Django thanks Cantina for reporting this issue.(CVE-2026-35192)\n\nAn issue was discovered in Django versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-3902)\n\nAn issue was discovered in Django\u0026apos;s GenericInlineModelAdmin component. Add permissions on inline model instances were not validated on submission of forged POST data. This vulnerability affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.(CVE-2026-4277)\n\nAn issue was discovered in Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.(CVE-2026-4292)\n\nWhen processing ASGI requests, if the Content-Length request header is deliberately omitted in a malicious request, or a false value is provided that is much smaller than the actual file, the system will be deceived, thereby bypassing Django\u0026apos;s built-in FILE_UPLOAD_MAX_MEMORY_SIZE (maximum memory file upload limit)(CVE-2026-5766)\n\n处理 ASGI 请求时，如果请求中缺少 Content-Length 请求头，或者人为提供了偏小的数值，就能绕过 Django 内置的 FILE_UPLOAD_MAX_MEMORY_SIZE（最大内存文件上传大小）限制(CVE-2026-6907)","status":"published","published":"2026-05-09T11:11:12Z","modified":"2026-08-18T01:19:51.855882793Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2219","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)\n\nThis issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie\u0026amp;#39;s response header does not change, but \u0026amp;quot;SESSION_SAVE_EVERY_REQUEST\u0026amp;quot; is \u0026amp;quot;true\u0026amp;quot;. A remote attacker could steal a user\u0026amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not been evaluated and may also be affected. Django thanks Cantina for reporting this issue.(CVE-2026-35192)\n\nAn issue was discovered in Django versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-3902)\n\nAn issue was discovered in Django\u0026apos;s GenericInlineModelAdmin component. Add permissions on inline model instances were not validated on submission of forged POST data. This vulnerability affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.(CVE-2026-4277)\n\nAn issue was discovered in Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.(CVE-2026-4292)\n\nWhen processing ASGI requests, if the Content-Length request header is deliberately omitted in a malicious request, or a false value is provided that is much smaller than the actual file, the system will be deceived, thereby bypassing Django\u0026apos;s built-in FILE_UPLOAD_MAX_MEMORY_SIZE (maximum memory file upload limit)(CVE-2026-5766)\n\n处理 ASGI 请求时，如果请求中缺少 Content-Length 请求头，或者人为提供了偏小的数值，就能绕过 Django 内置的 FILE_UPLOAD_MAX_MEMORY_SIZE（最大内存文件上传大小）限制(CVE-2026-6907)","status":"published","published":"2026-05-09T11:11:12Z","modified":"2026-08-18T01:19:51.980438394Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2220","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)\n\nAn issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)\n\nThis issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie\u0026amp;#39;s response header does not change, but \u0026amp;quot;SESSION_SAVE_EVERY_REQUEST\u0026amp;quot; is \u0026amp;quot;true\u0026amp;quot;. A remote attacker could steal a user\u0026amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not been evaluated and may also be affected. Django thanks Cantina for reporting this issue.(CVE-2026-35192)\n\nAn issue was discovered in Django versions 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.(CVE-2026-3902)\n\nAn issue was discovered in Django\u0026apos;s GenericInlineModelAdmin component. Add permissions on inline model instances were not validated on submission of forged POST data. This vulnerability affects Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank N05ec@LZU-DSLab for reporting this issue.(CVE-2026-4277)\n\nAn issue was discovered in Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.(CVE-2026-4292)\n\nWhen processing ASGI requests, if the Content-Length request header is deliberately omitted in a malicious request, or a false value is provided that is much smaller than the actual file, the system will be deceived, thereby bypassing Django\u0026apos;s built-in FILE_UPLOAD_MAX_MEMORY_SIZE (maximum memory file upload limit)(CVE-2026-5766)\n\n处理 ASGI 请求时，如果请求中缺少 Content-Length 请求头，或者人为提供了偏小的数值，就能绕过 Django 内置的 FILE_UPLOAD_MAX_MEMORY_SIZE（最大内存文件上传大小）限制(CVE-2026-6907)","status":"published","published":"2026-05-09T11:11:12Z","modified":"2026-08-18T01:19:51.886729603Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-53","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T15:17:46.65Z","modified":"2026-06-10T17:01:11.195676818Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2026-4292","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-07T14:00:00Z","modified":"2026-04-13T12:54:44.428978Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"BIT-django-2026-4292","title":"Privilege abuse in ModelAdmin.list_editable","description":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","status":"published","published":"2026-04-16T23:38:51.369Z","modified":"2026-09-08T08:46:42.895003048Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2026-1787220072","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post6+tuxcare.","status":"published","published":"2026-08-20T10:01:12Z","modified":"2026-10-15T09:48:05.580578862Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1793609074","title":"TuxCare security update for django (7 CVEs)","description":"TuxCare rebuilt django to address 7 CVEs. Fixed in 5.1.10.post8+tuxcare.","status":"published","published":"2026-11-02T09:44:35Z","modified":"2026-11-02T14:45:03.459214143Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793611298","title":"TuxCare security update for django (6 CVEs)","description":"TuxCare rebuilt django to address 6 CVEs. Fixed in 4.0.post26+tuxcare.","status":"published","published":"2026-11-02T10:21:39Z","modified":"2026-11-02T14:45:05.105577739Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793695167","title":"TuxCare security update for django (7 CVEs)","description":"TuxCare rebuilt django to address 7 CVEs. Fixed in 5.1.9.post10+tuxcare.","status":"published","published":"2026-11-03T09:39:28Z","modified":"2026-11-03T13:30:02.62599127Z","updated_at":"2026-11-03T14:04:50.729288Z"},{"id":"CLSA-2026-1793696695","title":"TuxCare security update for django (9 CVEs)","description":"TuxCare rebuilt django to address 9 CVEs. Fixed in 3.2.25.post14+tuxcare.","status":"published","published":"2026-11-03T10:04:56Z","modified":"2026-11-03T13:30:03.177764505Z","updated_at":"2026-11-03T14:04:50.729288Z"},{"id":"CLSA-2026-1793868799","title":"TuxCare security update for django (4 CVEs)","description":"TuxCare rebuilt django to address 4 CVEs. Fixed in 5.1.4.post11+tuxcare.","status":"published","published":"2026-11-05T09:53:20Z","modified":"2026-11-05T13:15:16.285741276Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"MGASA-2026-0093","title":"Updated python-django packages fix security vulnerabilities","description":"ASGI header spoofing via underscore/hyphen conflation. (CVE-2026-3902)\nPrivilege abuse in ``GenericInlineModelAdmin``. (CVE-2026-4277)\nPrivilege abuse in ``ModelAdmin.list_editable``. (CVE-2026-4292)\nPotential denial-of-service vulnerability in ``MultiPartParser`` via\nbase64-encoded file upload. (CVE-2026-33033)\nPotential denial-of-service vulnerability in ASGI requests via memory\nupload limit bypass. (CVE-2026-33034)\n","status":"published","published":"2026-04-11T23:02:03Z","modified":"2026-04-16T04:40:46.085607824Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10516-1","title":"python311-Django4-4.2.30-1.1 on GA media","description":"These are all security issues fixed in the python311-Django4-4.2.30-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-04-10T09:45:38.091732Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10517-1","title":"python313-Django6-6.0.4-1.1 on GA media","description":"These are all security issues fixed in the python313-Django6-6.0.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-09T00:00:00Z","modified":"2026-04-10T09:46:27.52198Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10567-1","title":"python311-Django-5.2.13-1.1 on GA media","description":"These are all security issues fixed in the python311-Django-5.2.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-16T00:00:00Z","modified":"2026-04-17T09:00:55.040556Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20578-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nChanges in python-Django:\n\n- CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation (bsc#1261729)\n- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin (bsc#1261731)\n- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable (bsc#1261732)\n- CVE-2026-33033: Potential denial-of-service vulnerability in\n  MultiPartParser via base64-encoded file upload (bsc#1261722)\n- CVE-2026-33034: Potential denial-of-service vulnerability in\n  ASGI requests via memory upload limit bypass (bsc#1261724)\n","status":"published","published":"2026-04-13T13:39:10Z","modified":"2026-04-22T18:24:37.836828Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1740-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues\n\n- CVE-2026-3902: headers spoofing by exploiting an ambiguous mapping of two header variants in `ASGIRequest` requests\n  (bsc#1261729).\n- CVE-2026-4277: permissions on inline model instances were not validated on submission of forged POST data in\n  GenericInlineModelAdmin (bsc#1261731).\n- CVE-2026-4292: admin changelist forms using ModelAdmin.list_editable incorrectly allowed new instances to be created\n  via forged POST data (bsc#1261732).\n- CVE-2026-5766: potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (bsc#1264153).\n- CVE-2026-6907: potential exposure of private data due to incorrect handling of `Vary: *` in `UpdateCacheMiddleware`\n  (bsc#1264152).\n- CVE-2026-33033: denial of service via missing or understated Content-Length header in ASGI requests (bsc#1261722).\n- CVE-2026-33034: ASGI requests with a missing or understated Content-Length header could bypass the\n  `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading HttpRequest.body (bsc#1261724).\n- CVE-2026-35192: session fixation via public cached pages and `SESSION_SAVE_EVERY_REQUEST` (bsc#1264154).\n","status":"published","published":"2026-05-07T07:00:32Z","modified":"2026-05-08T08:15:06.762076Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"USN-8154-1","title":"python-django vulnerabilities","description":"Seokchan Yoon discovered that Django incorrectly handled copying memory\nwhen parsing multipart uploads with excessive whitespace. A remote attacker\ncould possibly use this issue to cause Django to use excessive resources,\nleading to a denial of service. (CVE-2026-33033)\n\nIt was discovered that Django did not enforce an upload memory size limit\nin the Content-Length header. A remote attacker could possibly use this\nissue to cause Django to use excessive resources, leading to a denial of\nservice. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.\n(CVE-2026-33034)\n\nTarek Nakkouch discovered that Django incorrectly handled underscores in\nthe ASGI headers. A remote attacker could possibly use this issue to spoof\nHTTP headers. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,\nand Ubuntu 25.10. (CVE-2026-3902)\n\nIt was discovered that Django incorrectly handled verification of model\ndata created with POST requests. A remote attacker could possibly use this\nissue to forge new model permissions. (CVE-2026-4277, CVE-2026-4292)","status":"published","published":"2026-04-07T17:31:36Z","modified":"2026-04-27T19:02:46.189157204Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}