djangoproject Django
44 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-87975 | 6.1 – < 6.1.2 ; 6.0 – < 6.0.9 ; 5.2 – < 5.2.18 | Privilege abuse in model formsets with editable primary keys | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-87890 | 6.1 – < 6.1.2 ; 6.0 – < 6.0.9 ; 5.2 – < 5.2.18 | Potential request forgery via spatial lookup byte values | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-84429 | 6.1 – < 6.1.2 ; 6.0 – < 6.0.9 ; 5.2 – < 5.2.18 | Potential denial-of-service vulnerability in HTTP header parsing | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-77050 | 6.1 – < 6.1.2 ; 6.0 – < 6.0.9 ; 5.2 – < 5.2.18 | Potential denial-of-service vulnerability in get_supported_language_variant() | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-15920 | 6.0 – < 6.0.8 ; 5.2 – < 5.2.17 | Potential cross-site scripting via URLField values in the admin | MEDIUM 5.1 | 0.4 % | ||
| CVE-2026-15830 | 6.0 – < 6.0.9 ; 5.2 – < 5.2.18 | Potential denial-of-service vulnerability via nested geometry collections | MEDIUM 6.9 | 1.1 % | ||
| CVE-2026-15337 | 6.0 – < 6.0.8 ; 5.2 – < 5.2.17 | Potential denial-of-service vulnerability in check_for_language() | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-15307 | 6.0 – < 6.0.8 ; 5.2 – < 5.2.17 | Server-side file-write and request forgery via spatial lookups | HIGH 8.7 | 1.1 % | ||
| CVE-2026-53878 | 6.0 – < 6.0.7 ; 5.2 – < 5.2.16 | Header injection possibility since DomainNameValidator accepted newlines in input | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-53877 | 6.0 – < 6.0.7 ; 5.2 – < 5.2.16 | Heap buffer over-read in GDALRaster | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-48588 | 6.0 – < 6.0.7 ; 5.2 – < 5.2.16 | Potential exposure of private data via cached Set-Cookie response | LOW 2.3 | 0.4 % | ||
| CVE-2026-48587 | 6.0 – < 6.0.6 ; 5.2 – < 5.2.15 | Potential exposure of private data via whitespace padding in Vary header | LOW 2.3 | 0.4 % | ||
| CVE-2026-35193 | 6.0 – < 6.0.6 ; 5.2 – < 5.2.15 | Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware | LOW 2.3 | 0.4 % | ||
| CVE-2026-8404 | 6.0 – < 6.0.6 ; 5.2 – < 5.2.15 | Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware | LOW 2.3 | 0.3 % | ||
| CVE-2026-7666 | 6.0 – < 6.0.6 ; 5.2 – < 5.2.15 | Potential unencrypted email transmission via STARTTLS in the SMTP backend | LOW 2.3 | 0.1 % | ||
| CVE-2026-6873 | 6.0 – < 6.0.6 ; 5.2 – < 5.2.15 | Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie | LOW 2.3 | 0.2 % | ||
| CVE-2026-35192 | 6.0 – < 6.0.5 ; 5.2 – < 5.2.14 | Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST | LOW 2.3 | 0.5 % | ||
| CVE-2026-6907 | 6.0 – < 6.0.5 ; 5.2 – < 5.2.14 | Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware | LOW 2.3 | 0.4 % | ||
| CVE-2026-5766 | 6.0 – < 6.0.5 ; 5.2 – < 5.2.14 | Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-33034 | 6.0 – < 6.0.4 ; 5.2 – < 5.2.13 ; 4.2 – < 4.2.30 | Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass | HIGH 7.5 | 0.8 % | ||
| CVE-2026-33033 | 6.0 – < 6.0.4 ; 5.2 – < 5.2.13 ; 4.2 – < 4.2.30 | Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload | MEDIUM 6.5 | 0.9 % | ||
| CVE-2026-4292 | 6.0 – < 6.0.4 ; 5.2 – < 5.2.13 ; 4.2 – < 4.2.30 | Privilege abuse in ModelAdmin.list_editable | LOW 2.7 | 0.3 % | ||
| CVE-2026-4277 | 6.0 – < 6.0.4 ; 5.2 – < 5.2.13 ; 4.2 – < 4.2.30 | Privilege abuse in GenericInlineModelAdmin | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-3902 | 6.0 – < 6.0.4 ; 5.2 – < 5.2.13 ; 4.2 – < 4.2.30 | ASGI header spoofing via underscore/hyphen conflation | HIGH 7.5 | 0.4 % | ||
| CVE-2026-25674 | 6.0 – < 6.0.3 ; 5.2 – < 5.2.12 ; 4.2 – < 4.2.29 | Potential incorrect permissions on newly created file system objects | LOW 3.7 | 0.4 % | ||
| CVE-2026-25673 | 6.0 – < 6.0.3 ; 5.2 – < 5.2.12 ; 4.2 – < 4.2.29 | Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows | HIGH 7.5 | 0.8 % | ||
| CVE-2025-14550 | 6.0 – < 6.0.2 ; 5.2 – < 5.2.11 ; 4.2 – < 4.2.28 | Potential denial-of-service vulnerability via repeated headers when using ASGI | HIGH 7.5 | 1.1 % | ||
| CVE-2026-1312 | 6.0 – < 6.0.2 ; 5.2 – < 5.2.11 ; 4.2 – < 4.2.28 | Potential SQL injection via QuerySet.order_by and FilteredRelation | HIGH 8.5 | 0.9 % | ||
| CVE-2026-1287 | 6.0 – < 6.0.2 ; 5.2 – < 5.2.11 ; 4.2 – < 4.2.28 | Potential SQL injection in column aliases via control characters | HIGH 8.3 | 0.8 % | ||
| CVE-2026-1285 | 6.0 – < 6.0.2 ; 5.2 – < 5.2.11 ; 4.2 – < 4.2.28 | Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods | HIGH 7.5 | 1.1 % | ||
| CVE-2026-1207 | 6.0 – < 6.0.2 ; 5.2 – < 5.2.11 ; 4.2 – < 4.2.28 | Potential SQL injection via raster lookups on PostGIS | HIGH 8.3 | 13 % | ||
| CVE-2025-13473 | 6.0 – < 6.0.2 ; 5.2 – < 5.2.11 ; 4.2 – < 4.2.28 | Username enumeration through timing difference in mod_wsgi authentication handler | MEDIUM 5.3 | 0.8 % | ||
| CVE-2025-64460 | 5.2 – < 5.2.9 ; 5.1 – < 5.1.15 ; 4.2 – < 4.2.27 | Potential denial-of-service vulnerability in XML serializer text extraction | HIGH 7.5 | 2.1 % | ||
| CVE-2025-13372 | 5.2 – < 5.2.9 ; 5.1 – < 5.1.15 ; 4.2 – < 4.2.27 | Potential SQL injection in FilteredRelation column aliases on PostgreSQL | MEDIUM 4.3 | 0.9 % | ||
| CVE-2025-64459 | 5.2 – < 5.2.8 ; 5.1 – < 5.1.14 ; 4.2 – < 4.2.26 | Potential SQL injection via _connector keyword argument in QuerySet and Q objects | CRITICAL 9.1 | 19 % | ||
| CVE-2025-64458 | 5.2 – < 5.2.8 ; 5.1 – < 5.1.14 ; 4.2 – < 4.2.26 | Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows | HIGH 7.5 | 1.9 % | ||
| CVE-2025-59682 | 4.2 – < 4.2.25 ; 5.1 – < 5.1.13 ; 5.2 – < 5.2.7 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, u | MEDIUM 6.5 | 0.9 % | ||
| CVE-2025-59681 | 4.2 – < 4.2.25 ; 5.1 – < 5.1.13 ; 5.2 – < 5.2.7 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySe | CRITICAL 9.8 | 0.6 % | ||
| CVE-2025-57833 | 4.2 – < 4.2.24 ; 5.1 – < 5.1.12 ; 5.2 – < 5.2.6 | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection i | HIGH 8.1 | 26 % | ||
| CVE-2025-48432 | 4.2 – < 4.2.23 ; 5.1 – < 5.1.11 ; 5.2 – < 5.2.3 | An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape | MEDIUM 5.3 | 0.8 % | ||
| CVE-2025-32873 | 4.2 – < 4.2.21 ; 5.1 – < 5.1.9 ; 5.2 – < 5.2.1 | An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is | MEDIUM 5.3 | 14 % | ||
| CVE-2025-27556 | 5.0 – < 5.0.14 ; 5.1 – < 5.1.8 | An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, djang | HIGH 7.5 | 1.1 % | ||
| CVE-2025-26699 | 4.2 – < 4.2.20 ; 5.0 – < 5.0.13 ; 5.1 – < 5.1.7 | An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwr | HIGH 7.5 | 0.8 % | ||
| CVE-2024-56374 | 4.2 – < 4.2.18 ; 5.0 – < 5.0.11 ; 5.1 – < 5.1.5 | An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strin | HIGH 7.5 | 1.3 % |