djangoproject
- Total products in the ecosystem
- 3
- Total vulnerabilities (90 days)
- 10
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, djangoproject recorded 10 security vulnerabilities in the last 90 days across 1 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Django had the most security vulnerabilities in the djangoproject ecosystem, with 10 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114582Server-side request forgery via SpatialReference string inputCVE-2026-113733Password hash disclosure to "view only" admin users with custom user modelsCVE-2026-113593Potential exposure of private data via empty and missing Vary headersCVE-2026-111362Server-side request forgery via crs member of GeoJSON geometriesCVE-2026-111211Potential log injection via unescaped geometry form values| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-114582Server-side request forgery via SpatialReference string input | Exploitation statusNot exploited | FixYes |
| Published11/03/2026 |
| SeverityMedium |
CVE-2026-113733Password hash disclosure to "view only" admin users with custom user models | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/03/2026 | SeverityLow |
|---|
CVE-2026-113593Potential exposure of private data via empty and missing Vary headers | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/03/2026 | SeverityLow |
|---|
CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometries | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-111211Potential log injection via unescaped geometry form values | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file upload | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-87975Privilege abuse in model formsets with editable primary keys | Exploitation statusNot exploited | FixYes | Affected productDjango | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-87890Potential request forgery via spatial lookup byte values | Exploitation statusNot exploited | FixYes | Affected productDjango | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-84429Potential denial-of-service vulnerability in HTTP header parsing | Exploitation statusNot exploited | FixYes | Affected productDjango | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-77050Potential denial-of-service vulnerability in get_supported_language_variant() | Exploitation statusNot exploited | FixYes | Affected productDjango | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-15920Potential cross-site scripting via URLField values in the admin | Exploitation statusNot exploited | FixYes | Affected productDjango | Published08/04/2026 | SeverityMedium |
|---|
CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collections | Exploitation statusNot exploited | FixYes | Affected productDjango | Published08/04/2026 | SeverityMedium |
|---|
CVE-2026-15337Potential denial-of-service vulnerability in check_for_language() | Exploitation statusNot exploited | FixYes | Affected productDjango | Published08/04/2026 | SeverityMedium |
|---|
CVE-2026-15307djangoproject Django GeoDjango Spatial Lookups Enable Server-Side File Writes and SSRF | Exploitation statusNot exploited | FixYes | Affected productDjango | Published08/04/2026 | SeverityHigh |
|---|
CVE-2026-53878Header injection possibility since DomainNameValidator accepted newlines in input | Exploitation statusNot exploited | FixYes | Affected productDjango | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-53877Heap buffer over-read in GDALRaster | Exploitation statusNot exploited | FixYes | Affected productDjango | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-48588Potential exposure of private data via cached Set-Cookie response | Exploitation statusNot exploited | FixYes | Affected productDjango | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-8404Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware | Exploitation statusNot exploited | FixYes | Affected productDjango | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backend | Exploitation statusNot exploited | FixYes | Affected productDjango | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-6873Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie | Exploitation statusNot exploited | FixYes | Affected productDjango | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-48587Potential exposure of private data via whitespace padding in Vary header | Exploitation statusNot exploited | FixYes | Affected productDjango | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-44546Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing | Exploitation statusNot exploited | FixYes | Affected productdaphne | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-44545Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service | Exploitation statusNot exploited | FixYes | Affected productdaphne | Published06/03/2026 | SeverityMedium |
|---|
CVE-2026-35193Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware | Exploitation statusNot exploited | FixYes | Affected productDjango | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware | Exploitation statusNot exploited | FixYes | Affected productDjango | Published05/05/2026 | SeverityLow |
|---|
CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass | Exploitation statusNot exploited | FixYes | Affected productDjango | Published05/05/2026 | SeverityMedium |
|---|
CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST | Exploitation statusNot exploited | FixYes | Affected productDjango | Published05/05/2026 | SeverityLow |
|---|
CVE-2026-4292Privilege abuse in ModelAdmin.list_editable | Exploitation statusNot exploited | FixYes | Affected productDjango | Published04/07/2026 | SeverityLow |
|---|
CVE-2026-4277Privilege abuse in GenericInlineModelAdmin | Exploitation statusNot exploited | FixYes | Affected productDjango | Published04/07/2026 | SeverityCritical |
|---|
CVE-2026-3902ASGI header spoofing via underscore/hyphen conflation | Exploitation statusNot exploited | FixYes | Affected productDjango | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-33034Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass | Exploitation statusNot exploited | FixYes | Affected productDjango | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-33033Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload | Exploitation statusNot exploited | FixYes | Affected productDjango | Published04/07/2026 | SeverityMedium |
|---|
CVE-2026-25674Potential incorrect permissions on newly created file system objects | Exploitation statusNot exploited | FixYes | Affected productDjango | Published03/03/2026 | SeverityLow |
|---|
CVE-2026-25673Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows | Exploitation statusNot exploited | FixYes | Affected productDjango | Published03/03/2026 | SeverityHigh |
|---|
CVE-2026-1312Potential SQL injection via QuerySet.order_by and FilteredRelation | Exploitation statusNot exploited | FixYes | Affected productDjango | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1287Potential SQL injection in column aliases via control characters | Exploitation statusNot exploited | FixYes | Affected productDjango | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1285Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods | Exploitation statusNot exploited | FixYes | Affected productDjango | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1207Potential SQL injection via raster lookups on PostGIS | Exploitation statusNot exploited | FixYes | Affected productDjango | Published02/03/2026 | SeverityHigh |
|---|
CVE-2025-14550Potential denial-of-service vulnerability via repeated headers when using ASGI | Exploitation statusNot exploited | FixYes | Affected productasgiref | Published02/03/2026 | SeverityHigh |
|---|
CVE-2025-13473Username enumeration through timing difference in mod_wsgi authentication handler | Exploitation statusNot exploited | FixYes | Affected productDjango | Published02/03/2026 | SeverityMedium |
|---|
CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extraction | Exploitation statusNot exploited | FixYes | Affected productDjango | Published12/02/2025 | SeverityHigh |
|---|
CVE-2025-13372Potential SQL injection in FilteredRelation column aliases on PostgreSQL | Exploitation statusNot exploited | FixYes | Affected productDjango | Published12/02/2025 | SeverityMedium |
|---|
CVE-2025-64459Potential SQL injection via _connector keyword argument in QuerySet and Q objects | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/05/2025 | SeverityCritical |
|---|
CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows | Exploitation statusNot exploited | FixYes | Affected productDjango | Published11/05/2025 | SeverityHigh |
|---|
CVE-2025-59682CVE-2025-59682 | Exploitation statusNot exploited | FixYes | Affected productDjango | Published10/01/2025 | SeverityLow |
|---|
CVE-2025-59681CVE-2025-59681 | Exploitation statusNot exploited | FixYes | Affected productDjango | Published10/01/2025 | SeverityHigh |
|---|
CVE-2025-57833CVE-2025-57833 | Exploitation statusActively exploited | FixYes | Affected productDjango | Published09/03/2025 | SeverityHigh |
|---|
CVE-2025-48432CVE-2025-48432 | Exploitation statusNot exploited | FixYes | Affected productDjango | Published06/05/2025 | SeverityMedium |
|---|
CVE-2025-32873CVE-2025-32873 | Exploitation statusNot exploited | FixYes | Affected productDjango | Published05/08/2025 | SeverityMedium |
|---|
CVE-2025-27556CVE-2025-27556 | Exploitation statusNot exploited | FixYes | Affected productDjango | Published04/02/2025 | SeverityMedium |
|---|
52 Results | Page 1 of 2