Django
- Software type
- Web framework
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, Django recorded 10 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Django and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114582Server-side request forgery via SpatialReference string inputCVE-2026-113733Password hash disclosure to "view only" admin users with custom user modelsCVE-2026-113593Potential exposure of private data via empty and missing Vary headersCVE-2026-111362Server-side request forgery via crs member of GeoJSON geometriesCVE-2026-111211Potential log injection via unescaped geometry form values| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-114582Server-side request forgery via SpatialReference string input | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-113733Password hash disclosure to "view only" admin users with custom user models | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityLow |
|---|
CVE-2026-113593Potential exposure of private data via empty and missing Vary headers | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityLow |
|---|
CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometries | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-111211Potential log injection via unescaped geometry form values | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file upload | Exploitation statusNot exploited | FixYes | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-87975Privilege abuse in model formsets with editable primary keys | Exploitation statusNot exploited | FixYes | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-87890Potential request forgery via spatial lookup byte values | Exploitation statusNot exploited | FixYes | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-84429Potential denial-of-service vulnerability in HTTP header parsing | Exploitation statusNot exploited | FixYes | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-77050Potential denial-of-service vulnerability in get_supported_language_variant() | Exploitation statusNot exploited | FixYes | Published10/06/2026 | SeverityMedium |
|---|
CVE-2026-15920Potential cross-site scripting via URLField values in the admin | Exploitation statusNot exploited | FixYes | Published08/04/2026 | SeverityMedium |
|---|
CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collections | Exploitation statusNot exploited | FixYes | Published08/04/2026 | SeverityMedium |
|---|
CVE-2026-15337Potential denial-of-service vulnerability in check_for_language() | Exploitation statusNot exploited | FixYes | Published08/04/2026 | SeverityMedium |
|---|
CVE-2026-15307djangoproject Django GeoDjango Spatial Lookups Enable Server-Side File Writes and SSRF | Exploitation statusNot exploited | FixYes | Published08/04/2026 | SeverityHigh |
|---|
CVE-2026-53878Header injection possibility since DomainNameValidator accepted newlines in input | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-53877Heap buffer over-read in GDALRaster | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-48588Potential exposure of private data via cached Set-Cookie response | Exploitation statusNot exploited | FixYes | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-8404Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware | Exploitation statusNot exploited | FixYes | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backend | Exploitation statusNot exploited | FixYes | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-6873Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie | Exploitation statusNot exploited | FixYes | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-48587Potential exposure of private data via whitespace padding in Vary header | Exploitation statusNot exploited | FixYes | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-35193Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware | Exploitation statusNot exploited | FixYes | Published06/03/2026 | SeverityLow |
|---|
CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityLow |
|---|
CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityMedium |
|---|
CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityLow |
|---|
CVE-2026-4292Privilege abuse in ModelAdmin.list_editable | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityLow |
|---|
CVE-2026-4277Privilege abuse in GenericInlineModelAdmin | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityCritical |
|---|
CVE-2026-3902ASGI header spoofing via underscore/hyphen conflation | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-33034Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityHigh |
|---|
CVE-2026-33033Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload | Exploitation statusNot exploited | FixYes | Published04/07/2026 | SeverityMedium |
|---|
CVE-2026-25674Potential incorrect permissions on newly created file system objects | Exploitation statusNot exploited | FixYes | Published03/03/2026 | SeverityLow |
|---|
CVE-2026-25673Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows | Exploitation statusNot exploited | FixYes | Published03/03/2026 | SeverityHigh |
|---|
CVE-2026-1312Potential SQL injection via QuerySet.order_by and FilteredRelation | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1287Potential SQL injection in column aliases via control characters | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1285Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1207Potential SQL injection via raster lookups on PostGIS | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2025-14550Potential denial-of-service vulnerability via repeated headers when using ASGI | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityHigh |
|---|
CVE-2025-13473Username enumeration through timing difference in mod_wsgi authentication handler | Exploitation statusNot exploited | FixYes | Published02/03/2026 | SeverityMedium |
|---|
CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extraction | Exploitation statusNot exploited | FixYes | Published12/02/2025 | SeverityHigh |
|---|
CVE-2025-13372Potential SQL injection in FilteredRelation column aliases on PostgreSQL | Exploitation statusNot exploited | FixYes | Published12/02/2025 | SeverityMedium |
|---|
CVE-2025-64459Potential SQL injection via _connector keyword argument in QuerySet and Q objects | Exploitation statusNot exploited | FixYes | Published11/05/2025 | SeverityCritical |
|---|
CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows | Exploitation statusNot exploited | FixYes | Published11/05/2025 | SeverityHigh |
|---|
CVE-2025-59682CVE-2025-59682 | Exploitation statusNot exploited | FixYes | Published10/01/2025 | SeverityLow |
|---|
CVE-2025-59681CVE-2025-59681 | Exploitation statusNot exploited | FixYes | Published10/01/2025 | SeverityHigh |
|---|
CVE-2025-57833CVE-2025-57833 | Exploitation statusActively exploited | FixYes | Published09/03/2025 | SeverityHigh |
|---|
CVE-2025-48432CVE-2025-48432 | Exploitation statusNot exploited | FixYes | Published06/05/2025 | SeverityMedium |
|---|
CVE-2025-32873CVE-2025-32873 | Exploitation statusNot exploited | FixYes | Published05/08/2025 | SeverityMedium |
|---|
CVE-2025-27556CVE-2025-27556 | Exploitation statusNot exploited | FixYes | Published04/02/2025 | SeverityMedium |
|---|
CVE-2025-26699CVE-2025-26699 | Exploitation statusNot exploited | FixYes | Published03/06/2025 | SeverityMedium |
|---|
CVE-2024-56374CVE-2024-56374 | Exploitation statusNot exploited | FixYes | Published01/14/2025 | SeverityMedium |
|---|
50 Results | Page 1 of 1