https://vulnogram.org/ Most recent CVEs assigned by Django Software Foundation (dsf). https://vulnogram.org/seaview/icons/dsf.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-87975 https://vulnogram.org/CVE-2026-87975 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instanc… Medium Tue, 06 Oct 2026 13:35:59 GMT https://vulnogram.org/CVE-2026-87890 https://vulnogram.org/CVE-2026-87890 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network r… Medium Tue, 06 Oct 2026 13:35:37 GMT https://vulnogram.org/CVE-2026-84429 https://vulnogram.org/CVE-2026-84429 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with… Medium Tue, 06 Oct 2026 13:35:17 GMT https://vulnogram.org/CVE-2026-77050 https://vulnogram.org/CVE-2026-77050 An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subject to a potential denial-of-service attack when processing many distinct, very long langu… Medium Tue, 06 Oct 2026 13:34:40 GMT https://vulnogram.org/CVE-2026-15920 https://vulnogram.org/CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is d… Medium Tue, 04 Aug 2026 15:48:40 GMT https://vulnogram.org/CVE-2026-15830 https://vulnogram.org/CVE-2026-15830 An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known te… Medium Tue, 04 Aug 2026 15:48:34 GMT https://vulnogram.org/CVE-2026-15337 https://vulnogram.org/CVE-2026-15337 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as key… Medium Tue, 04 Aug 2026 15:48:25 GMT https://vulnogram.org/CVE-2026-15307 https://vulnogram.org/CVE-2026-15307 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a… High Tue, 04 Aug 2026 15:48:18 GMT https://vulnogram.org/CVE-2026-53878 https://vulnogram.org/CVE-2026-53878 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines… Medium Tue, 07 Jul 2026 14:10:29 GMT https://vulnogram.org/CVE-2026-53877 https://vulnogram.org/CVE-2026-53877 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a… Medium Tue, 07 Jul 2026 14:10:04 GMT https://vulnogram.org/CVE-2026-48588 https://vulnogram.org/CVE-2026-48588 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers… Medium Tue, 07 Jul 2026 14:09:32 GMT https://vulnogram.org/CVE-2026-44546 https://vulnogram.org/CVE-2026-44546 daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decode… Low Network Exploitable Wed, 03 Jun 2026 13:17:55 GMT https://vulnogram.org/CVE-2026-44545 https://vulnogram.org/CVE-2026-44545 daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket mess… Medium Network Exploitable Wed, 03 Jun 2026 13:17:42 GMT https://vulnogram.org/CVE-2026-48587 https://vulnogram.org/CVE-2026-48587 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attacke… Low Wed, 03 Jun 2026 13:16:47 GMT https://vulnogram.org/CVE-2026-35193 https://vulnogram.org/CVE-2026-35193 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: pu… Low Wed, 03 Jun 2026 13:16:38 GMT https://vulnogram.org/CVE-2026-8404 https://vulnogram.org/CVE-2026-8404 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses… Low Wed, 03 Jun 2026 13:16:29 GMT https://vulnogram.org/CVE-2026-7666 https://vulnogram.org/CVE-2026-7666 An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=Tru… Low Wed, 03 Jun 2026 13:16:15 GMT https://vulnogram.org/CVE-2026-6873 https://vulnogram.org/CVE-2026-6873 An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to… Low Wed, 03 Jun 2026 13:16:03 GMT https://vulnogram.org/CVE-2026-35192 https://vulnogram.org/CVE-2026-35192 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a… Low Tue, 05 May 2026 14:50:29 GMT https://vulnogram.org/CVE-2026-6907 https://vulnogram.org/CVE-2026-6907 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and serve… Medium Tue, 05 May 2026 14:50:02 GMT https://vulnogram.org/CVE-2026-5766 https://vulnogram.org/CVE-2026-5766 An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service… Medium Tue, 05 May 2026 14:49:19 GMT https://vulnogram.org/CVE-2026-33034 https://vulnogram.org/CVE-2026-33034 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading `HttpRequest.body`, allowing… High Network Exploitable Tue, 07 Apr 2026 14:22:59 GMT https://vulnogram.org/CVE-2026-33033 https://vulnogram.org/CVE-2026-33033 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive white… Medium Tue, 07 Apr 2026 14:22:48 GMT https://vulnogram.org/CVE-2026-4292 https://vulnogram.org/CVE-2026-4292 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series… Low Tue, 07 Apr 2026 14:22:38 GMT https://vulnogram.org/CVE-2026-4277 https://vulnogram.org/CVE-2026-4277 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged `POST` data in `GenericInlineModelAdmin`. Earlier, unsupported Django series (… Critical Network Exploitable Tue, 07 Apr 2026 14:22:25 GMT https://vulnogram.org/CVE-2026-3902 https://vulnogram.org/CVE-2026-3902 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single ve… High Network Exploitable Tue, 07 Apr 2026 14:22:07 GMT https://vulnogram.org/CVE-2026-25674 https://vulnogram.org/CVE-2026-25674 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissi… Low Network Exploitable Tue, 03 Mar 2026 14:28:37 GMT https://vulnogram.org/CVE-2026-25673 https://vulnogram.org/CVE-2026-25673 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode… High Network Exploitable Tue, 03 Mar 2026 14:28:28 GMT https://vulnogram.org/CVE-2025-14550 https://vulnogram.org/CVE-2025-14550 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django se… High Network Exploitable Tue, 03 Feb 2026 14:38:15 GMT https://vulnogram.org/CVE-2026-1312 https://vulnogram.org/CVE-2026-1312 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionar… High Tue, 03 Feb 2026 14:36:23 GMT https://vulnogram.org/CVE-2026-1287 https://vulnogram.org/CVE-2026-1287 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**… High Tue, 03 Feb 2026 14:36:03 GMT https://vulnogram.org/CVE-2026-1285 https://vulnogram.org/CVE-2026-1285 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters all… High Network Exploitable Tue, 03 Feb 2026 14:35:50 GMT https://vulnogram.org/CVE-2026-1207 https://vulnogram.org/CVE-2026-1207 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django ser… High Network Exploitable Tue, 03 Feb 2026 14:35:33 GMT https://vulnogram.org/CVE-2025-13473 https://vulnogram.org/CVE-2025-13473 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing atta… Medium Tue, 03 Feb 2026 14:32:26 GMT https://vulnogram.org/CVE-2025-64460 https://vulnogram.org/CVE-2025-64460 An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering… High Network Exploitable Tue, 02 Dec 2025 15:15:34 GMT https://vulnogram.org/CVE-2025-13372 https://vulnogram.org/CVE-2025-13372 An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `Quer… Medium Network Exploitable Tue, 02 Dec 2025 15:13:35 GMT https://vulnogram.org/CVE-2025-64459 https://vulnogram.org/CVE-2025-64459 An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictio… Critical Network Exploitable Wed, 05 Nov 2025 15:09:58 GMT https://vulnogram.org/CVE-2025-64458 https://vulnogram.org/CVE-2025-64458 An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcu… High Network Exploitable Wed, 05 Nov 2025 15:07:17 GMT