Djangoproject vulnerabilities

Products

• Django 167
• Daphne 2

Newest

• djangoproject django Server-side request forgery via SpatialReference string input CVE-2026-114582 Fix available 6.9 MediumNovember 3, 2026
• djangoproject django Password hash disclosure to "view only" admin users with custom user models CVE-2026-113733 2.1 LowNovember 3, 2026
• djangoproject django Potential exposure of private data via empty and missing Vary headers CVE-2026-113593 Fix available 2.3 LowNovember 3, 2026
• djangoproject django Server-side request forgery via crs member of GeoJSON geometries CVE-2026-111362 Fix available 6.9 MediumNovember 3, 2026
• djangoproject django Potential log injection via unescaped geometry form values CVE-2026-111211 Fix available 6.9 MediumNovember 3, 2026
• djangoproject django Potential memory exhaustion in MultiPartParser via base64-encoded file upload CVE-2026-108147 Fix available 6.9 MediumNovember 3, 2026
• djangoproject django Privilege abuse in model formsets with editable primary keys CVE-2026-87975 Fix available 5.3 MediumOctober 6, 2026
• djangoproject django Potential request forgery via spatial lookup byte values CVE-2026-87890 Fix available 6.9 MediumOctober 6, 2026
• djangoproject django Potential denial-of-service vulnerability in HTTP header parsing CVE-2026-84429 Fix available 6.9 MediumOctober 6, 2026
• djangoproject django Potential denial-of-service vulnerability in get_supported_language_variant() CVE-2026-77050 Fix available 6.9 MediumOctober 6, 2026
• djangoproject django Potential cross-site scripting via URLField values in the admin CVE-2026-15920 Fix available 5.1 MediumAugust 4, 2026
• djangoproject django Potential denial-of-service vulnerability via nested geometry collections CVE-2026-15830 Fix available 6.9 MediumAugust 4, 2026
• djangoproject django Potential denial-of-service vulnerability in check_for_language() CVE-2026-15337 Fix available 6.9 MediumAugust 4, 2026
• djangoproject django Server-side file-write and request forgery via spatial lookups CVE-2026-15307 Fix available 8.7 HighAugust 4, 2026
• djangoproject django Header injection possibility since DomainNameValidator accepted newlines in input CVE-2026-53878 Fix available 5.3 MediumJuly 7, 2026
• djangoproject django Heap buffer over-read in GDALRaster CVE-2026-53877 Fix available 6.3 MediumJuly 7, 2026
• djangoproject django Potential exposure of private data via cached Set-Cookie response CVE-2026-48588 Fix available 2.3 LowJuly 7, 2026
• djangoproject daphne Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing CVE-2026-44546 Fix available 3.7 LowJune 3, 2026
• djangoproject daphne Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service CVE-2026-44545 Fix available 5.3 MediumJune 3, 2026
• djangoproject django Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware CVE-2026-8404 Fix available 2.3 LowJune 3, 2026
• djangoproject django Potential unencrypted email transmission via STARTTLS in the SMTP backend CVE-2026-7666 Fix available 2.3 LowJune 3, 2026
• djangoproject django Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie CVE-2026-6873 Fix available 2.3 LowJune 3, 2026
• djangoproject django Potential exposure of private data via whitespace padding in Vary header CVE-2026-48587 Fix available 2.3 LowJune 3, 2026
• djangoproject django Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware CVE-2026-35193 Fix available 2.3 LowJune 3, 2026
• djangoproject django Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware CVE-2026-6907 Fix available 2.3 LowMay 5, 2026
• djangoproject django Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass CVE-2026-5766 Fix available 6.3 MediumMay 5, 2026
• djangoproject django Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST CVE-2026-35192 Fix available 2.3 LowMay 5, 2026
• djangoproject django Privilege abuse in ModelAdmin.list_editable CVE-2026-4292 Fix available 2.7 LowApril 7, 2026
• djangoproject django Privilege abuse in GenericInlineModelAdmin CVE-2026-4277 Fix available 9.8 CriticalApril 7, 2026
• djangoproject django ASGI header spoofing via underscore/hyphen conflation CVE-2026-3902 Fix available 7.5 HighApril 7, 2026
• djangoproject django Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass CVE-2026-33034 Fix available 7.5 HighApril 7, 2026
• djangoproject django Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload CVE-2026-33033 Public exploitFix available 6.5 MediumApril 7, 2026
• djangoproject django, red hat ansible automation platform 2, discovery 2 +1 more +3 more Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows CVE-2026-25673 Fix available 7.5 HighMarch 3, 2026
• djangoproject django Potential incorrect permissions on newly created file system objects CVE-2026-25674 Fix available 3.7 LowMarch 3, 2026
• djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 more Potential SQL injection via QuerySet.order_by and FilteredRelation CVE-2026-1312 Public exploitFix available 5.4 MediumFebruary 3, 2026
• djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 more Potential SQL injection in column aliases via control characters CVE-2026-1287 Fix available 5.4 MediumFebruary 3, 2026
• djangoproject django Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods CVE-2026-1285 Fix available 7.5 HighFebruary 3, 2026
• djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 more Potential SQL injection via raster lookups on PostGIS CVE-2026-1207 Public exploitFix available EPSS 12.8% 5.4 MediumFebruary 3, 2026
• djangoproject django, asgiref +1 more Potential denial-of-service vulnerability via repeated headers when using ASGI CVE-2025-14550 Fix available 7.5 HighFebruary 3, 2026
• djangoproject django Username enumeration through timing difference in mod_wsgi authentication handler CVE-2025-13473 Fix available 5.3 MediumFebruary 3, 2026
• djangoproject django Potential denial-of-service vulnerability in XML serializer text extraction CVE-2025-64460 Fix available 7.5 HighDecember 2, 2025
• djangoproject django Potential SQL injection in FilteredRelation column aliases on PostgreSQL CVE-2025-13372 Fix available 4.3 MediumDecember 2, 2025
• djangoproject django Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows CVE-2025-64458 Public exploitFix available 7.5 HighNovember 5, 2025
• djangoproject django Potential SQL injection via _connector keyword argument in QuerySet and Q objects CVE-2025-64459 Public exploitFix available EPSS 19.3% 9.1 CriticalNovember 5, 2025
• djangoproject django Django vulnerable to partial directory traversal via archives CVE-2025-59682 Fix available 3.1 LowOctober 1, 2025
• djangoproject django Django vulnerable to SQL injection in column aliases CVE-2025-59681 Fix available 7.1 HighOctober 1, 2025
• djangoproject django, debian linux +1 more Django Improper Output Neutralization for Logs vulnerability CVE-2025-48432 Fix available 4.0 MediumJune 4, 2025
• djangoproject django Django has a denial-of-service possibility in strip_tags() CVE-2025-32873 Public exploitFix available EPSS 14.3% 5.3 MediumMay 7, 2025
• djangoproject django Django Potential Denial of Service (DoS) on Windows CVE-2025-27556 Fix available 5.8 MediumApril 2, 2025
• djangoproject django Django is subject to SQL injection through its column aliases CVE-2025-57833 Public exploitFix available EPSS 28.3% 7.1 HighMarch 9, 2025
• Show olderLoading…