# cve.now: Django

The newest entries affecting Django (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114138](https://cve.now/CVE-2026-114138.md): Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation (CVSS 7.5, encode django-rest-framework · djangorestframework)
- [CVE-2026-114137](https://cve.now/CVE-2026-114137.md): Django REST framework: TokenProxy.delete() reports success and revokes nothing (CVSS 7.4, encode django-rest-framework · djangorestframework)
- [CVE-2026-114136](https://cve.now/CVE-2026-114136.md): Django REST framework: JSONParser applies an attacker-named codec to the request stream (CVSS 7.5, encode django-rest-framework · djangorestframework)
- [CVE-2026-87975](https://cve.now/CVE-2026-87975.md): Privilege abuse in model formsets with editable primary keys (CVSS 4.3, djangoproject Django)
- [CVE-2026-87890](https://cve.now/CVE-2026-87890.md): Potential request forgery via spatial lookup byte values (CVSS 5.3, djangoproject Django)
- [CVE-2026-84429](https://cve.now/CVE-2026-84429.md): Potential denial-of-service vulnerability in HTTP header parsing (CVSS 5.3, djangoproject Django)
- [CVE-2026-77050](https://cve.now/CVE-2026-77050.md): Potential denial-of-service vulnerability in get\_supported\_language\_variant() (CVSS 5.3, djangoproject Django)
- [CVE-2026-105392](https://cve.now/CVE-2026-105392.md): Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key (CVSS 6.9, Lybbn Django-Vue-Lyadmin)
- [CVE-2026-105315](https://cve.now/CVE-2026-105315.md): django-haystack more\_like\_this Template Tag elasticsearch\_backend.py \_to\_python eval injection (CVSS 5.1, django-haystack)
- [CVE-2026-97764](https://cve.now/CVE-2026-97764.md): django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker (CVSS 3.7, django-allauth)
- [CVE-2026-93456](https://cve.now/CVE-2026-93456.md): django-page-cms through 2.0.13 CSRF via admin mutation views (CVSS 8.4, batiste django-page-cms)
- [CVE-2026-93455](https://cve.now/CVE-2026-93455.md): django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account (CVSS 7.1, batiste django-page-cms)
- [CVE-2026-90806](https://cve.now/CVE-2026-90806.md): DjangoCRM django-crm Bulk Case Update bulk\_views.py BulkUpdateCasesView authorization (CVSS 5.3, DjangoCRM django-crm)
- [CVE-2026-82835](https://cve.now/CVE-2026-82835.md): caoqianming django-vue-admin file access control (CVSS 5.3, caoqianming django-vue-admin)
- [CVE-2026-75526](https://cve.now/CVE-2026-75526.md): django CMS: Stored XSS in edit-mode plugin exception rendering (CVSS 4.4, django-cms)
- [CVE-2026-63003](https://cve.now/CVE-2026-63003.md): django CMS: Broken access control in page \*Duplicate\* allows reading the content of any page (cross-site / restriction bypass) (CVSS 6.5, django-cms)
- [CVE-2026-61663](https://cve.now/CVE-2026-61663.md): django CMS: Missing authorization in \`render\_object\_structure\` discloses non-PageContent placeholder structure to low-privileged staff (CVSS 4.3, django-cms)
- [CVE-2026-54622](https://cve.now/CVE-2026-54622.md): django CMS: Clipboard copy IDOR discloses unauthorized plugin content (CVSS 6.5, django-cms)
- [CVE-2026-54624](https://cve.now/CVE-2026-54624.md): django CMS: Structure endpoint bypasses page-view permission (CVSS 6.5, django-cms)
- [CVE-2026-54623](https://cve.now/CVE-2026-54623.md): django CMS: Plugin move endpoint allows cyclic reparenting (DoS) (CVSS 7.1, django-cms)
- [CVE-2026-54625](https://cve.now/CVE-2026-54625.md): django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) (CVSS 4.8, django-cms)
- [CVE-2026-73531](https://cve.now/CVE-2026-73531.md): django-helpdesk \< 2.3.3 Stored XSS via HTML Attachments (CVSS 5.3, django-helpdesk)
- [CVE-2026-73229](https://cve.now/CVE-2026-73229.md): Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests (CVSS 4.3, encode django-rest-framework · djangorestframework)
- [CVE-2026-73228](https://cve.now/CVE-2026-73228.md): Django REST framework: Potential bypass of Django \`DATA\_UPLOAD\_MAX\_MEMORY\_SIZE\` when parsing oversized JSON and urlencoded request bodies via DRF \`request.data\` (CVSS 5.3, encode django-rest-framework · djangorestframework)
- [CVE-2026-71240](https://cve.now/CVE-2026-71240.md): DjangoCRM - Unauthenticated Open Redirect via toggle\_default\_sorting next\_url Parameter (CVSS 4.3, DjangoCRM django-crm)
- [CVE-2026-71239](https://cve.now/CVE-2026-71239.md): DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering (CVSS 8.1, DjangoCRM django-crm)
- [CVE-2026-71238](https://cve.now/CVE-2026-71238.md): DjangoCRM - Hardcoded Django SECRET\_KEY Enables Session and CSRF Token Forgery (CVSS 9.1, DjangoCRM django-crm)
- [CVE-2026-18818](https://cve.now/CVE-2026-18818.md): Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization (CVSS 5.3, Ehco1996 django-sspanel)
- [CVE-2026-15920](https://cve.now/CVE-2026-15920.md): Potential cross-site scripting via URLField values in the admin (CVSS 6.1, djangoproject Django)
- [CVE-2026-15830](https://cve.now/CVE-2026-15830.md): Potential denial-of-service vulnerability via nested geometry collections (CVSS 5.3, djangoproject Django · django)
- [CVE-2026-15337](https://cve.now/CVE-2026-15337.md): Potential denial-of-service vulnerability in check\_for\_language() (CVSS 5.3, djangoproject Django)
- [CVE-2026-15307](https://cve.now/CVE-2026-15307.md): Server-side file-write and request forgery via spatial lookups (CVSS 8.8, djangoproject Django · django)
- [CVE-2026-16216](https://cve.now/CVE-2026-16216.md): geex-arts django-jet OAuth cross-site request forgery (CVSS 5.3, geex-arts django-jet)
- [CVE-2026-16215](https://cve.now/CVE-2026-16215.md): geex-arts django-jet OAuth Credential Revoke authorization (CVSS 6.9, geex-arts django-jet)
- [CVE-2026-16214](https://cve.now/CVE-2026-16214.md): geex-arts django-jet Dashboard views.py authorization (CVSS 5.3, geex-arts django-jet)
- [CVE-2026-16213](https://cve.now/CVE-2026-16213.md): Fantomas42 django-blog-zinnia Protected Entry Password entry\_protection.py cleartext storage (CVSS 4.8, Fantomas42 django-blog-zinnia)
- [CVE-2026-16212](https://cve.now/CVE-2026-16212.md): awesto django-shop Purchase Stock inventory.py race condition (CVSS 2.3, awesto django-shop)
- [CVE-2026-16208](https://cve.now/CVE-2026-16208.md): django-tastypie throttle.py CacheDBThrottle race condition (CVSS 2.3, django-tastypie)
- [CVE-2026-16207](https://cve.now/CVE-2026-16207.md): django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings (CVSS 6.3, django-tastypie)
- [CVE-2026-16206](https://cve.now/CVE-2026-16206.md): django-oauth django-oauth-toolkit oauth2\_validators.py \_load\_id\_token session expiration (CVSS 5.3, django-oauth-toolkit)
- [CVE-2026-15188](https://cve.now/CVE-2026-15188.md): manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control (CVSS 5.3, manjurulhoque django-job-portal)
- [CVE-2026-53878](https://cve.now/CVE-2026-53878.md): Header injection possibility since DomainNameValidator accepted newlines in input (CVSS 6.1, djangoproject Django · django)
- [CVE-2026-53877](https://cve.now/CVE-2026-53877.md): Heap buffer over-read in GDALRaster (CVSS 4.8, djangoproject Django · django)
- [CVE-2026-48588](https://cve.now/CVE-2026-48588.md): Potential exposure of private data via cached Set-Cookie response (CVSS 4.2, djangoproject Django · django)
- [CVE-2026-48587](https://cve.now/CVE-2026-48587.md): Potential exposure of private data via whitespace padding in Vary header (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-35193](https://cve.now/CVE-2026-35193.md): Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-8404](https://cve.now/CVE-2026-8404.md): Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-7666](https://cve.now/CVE-2026-7666.md): Potential unencrypted email transmission via STARTTLS in the SMTP backend (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-6873](https://cve.now/CVE-2026-6873.md): Signed cookie salt namespace collision in django.http.HttpRequest.get\_signed\_cookie (CVSS 3.1, djangoproject Django · django)
- [CVE-2026-42196](https://cve.now/CVE-2026-42196.md): django-s3file: Relative path traversal (CVSS 9.9, codingjoe django-s3file · django-s3file)
- [CVE-2026-35192](https://cve.now/CVE-2026-35192.md): Session fixation via public cached pages and SESSION\_SAVE\_EVERY\_REQUEST (CVSS 2.3, djangoproject Django · django)
- [CVE-2026-6907](https://cve.now/CVE-2026-6907.md): Potential exposure of private data due to incorrect handling of Vary: \* in UpdateCacheMiddleware (CVSS 4.3, djangoproject Django · django)
- [CVE-2026-5766](https://cve.now/CVE-2026-5766.md): Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (CVSS 5.3, djangoproject Django · django)
- [CVE-2025-13030](https://cve.now/CVE-2025-13030.md): All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. (CVSS 5.1, django-mdeditor)
- [CVE-2026-33034](https://cve.now/CVE-2026-33034.md): Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass (CVSS 7.5, djangoproject Django · django)
- [CVE-2026-33033](https://cve.now/CVE-2026-33033.md): Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (CVSS 6.5, djangoproject Django · django)
- [CVE-2026-4292](https://cve.now/CVE-2026-4292.md): Privilege abuse in ModelAdmin.list\_editable (CVSS 2.7, djangoproject Django · django)
- [CVE-2026-4277](https://cve.now/CVE-2026-4277.md): Privilege abuse in GenericInlineModelAdmin (CVSS 9.8, djangoproject Django · django)
- [CVE-2026-3902](https://cve.now/CVE-2026-3902.md): ASGI header spoofing via underscore/hyphen conflation (CVSS 7.5, djangoproject Django · django)
- [CVE-2026-31815](https://cve.now/CVE-2026-31815.md): django-unicorn affected by component state manipulation via unvalidated attribute access (CVSS 5.3, django-commons django-unicorn · django-unicorn)
- [CVE-2026-27982](https://cve.now/CVE-2026-27982.md): An open redirect vulnerability exists in django-allauth versions prior to 65.14.1 when SAML IdP initiated SSO is enabled (it is disabled by (CVSS 4.3, django-allauth)
- [CVE-2026-25674](https://cve.now/CVE-2026-25674.md): Potential incorrect permissions on newly created file system objects (CVSS 3.7, djangoproject Django · django)
- [CVE-2026-25673](https://cve.now/CVE-2026-25673.md): Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows (CVSS 7.5, djangoproject Django · django)
- [CVE-2025-14550](https://cve.now/CVE-2025-14550.md): Potential denial-of-service vulnerability via repeated headers when using ASGI (CVSS 7.5, djangoproject Django · djangoproject asgiref +1)
- [CVE-2026-1312](https://cve.now/CVE-2026-1312.md): Potential SQL injection via QuerySet.order\_by and FilteredRelation (CVSS 5.4, djangoproject Django · django)
- [CVE-2026-1287](https://cve.now/CVE-2026-1287.md): Potential SQL injection in column aliases via control characters (CVSS 5.4, djangoproject Django · django)
- [CVE-2026-1285](https://cve.now/CVE-2026-1285.md): Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods (CVSS 7.5, djangoproject Django · django)
- [CVE-2026-1207](https://cve.now/CVE-2026-1207.md): Potential SQL injection via raster lookups on PostGIS (CVSS 5.4, djangoproject Django · django)
- [CVE-2025-13473](https://cve.now/CVE-2025-13473.md): Username enumeration through timing difference in mod\_wsgi authentication handler (CVSS 5.3, djangoproject Django · django)
- [CVE-2025-64460](https://cve.now/CVE-2025-64460.md): Potential denial-of-service vulnerability in XML serializer text extraction (CVSS 7.5, djangoproject Django · django)
- [CVE-2025-13372](https://cve.now/CVE-2025-13372.md): Potential SQL injection in FilteredRelation column aliases on PostgreSQL (CVSS 4.3, djangoproject Django · django)
- [CVE-2025-64459](https://cve.now/CVE-2025-64459.md): Potential SQL injection via \_connector keyword argument in QuerySet and Q objects (CVSS 9.1, djangoproject Django · django)
- [CVE-2025-64458](https://cve.now/CVE-2025-64458.md): Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows (CVSS 7.5, djangoproject Django · django)
- [CVE-2025-59681](https://cve.now/CVE-2025-59681.md): An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. (CVSS 7.1, djangoproject Django · django)
- [CVE-2025-59682](https://cve.now/CVE-2025-59682.md): An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. (CVSS 3.1, djangoproject Django · django)
- [CVE-2025-57833](https://cve.now/CVE-2025-57833.md): An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. (CVSS 7.1, djangoproject Django · django)
- [CVE-2025-7738](https://cve.now/CVE-2025-7738.md): Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap (CVSS 4.4, django-ansible-base · Red Hat Ansible Automation Platform 2…)
- [CVE-2025-48432](https://cve.now/CVE-2025-48432.md): An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. (CVSS 4.0, djangoproject Django · django)
- [CVE-2018-25111](https://cve.now/CVE-2018-25111.md): django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py. (CVSS 5.1, django-helpdesk Project django-helpdesk · django-helpdesk)
- [CVE-2025-48383](https://cve.now/CVE-2025-48383.md): Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking (CVSS 8.2, codingjoe django-select2 · django-select2)
- [CVE-2025-4894](https://cve.now/CVE-2025-4894.md): calmkart Django-sso-server crypto.py gen\_rsa\_keys inadequate encryption (CVSS 6.3, calmkart Django-sso-server)
- [CVE-2025-32873](https://cve.now/CVE-2025-32873.md): An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. (CVSS 5.3, djangoproject Django · django)
- [CVE-2025-27556](https://cve.now/CVE-2025-27556.md): An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. (CVSS 5.8, djangoproject Django · django)
- [CVE-2025-26699](https://cve.now/CVE-2025-26699.md): An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. (CVSS 5.0, djangoproject Django · django)
- [CVE-2025-24370](https://cve.now/CVE-2025-24370.md): Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass (CVSS 9.3, adamghill django-unicorn · django-unicorn)
- [CVE-2024-56374](https://cve.now/CVE-2024-56374.md): An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. (CVSS 5.8, djangoproject Django · django)
- [CVE-2024-53907](https://cve.now/CVE-2024-53907.md): An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. (CVSS 7.5, django)
- [CVE-2024-53908](https://cve.now/CVE-2024-53908.md): An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. (CVSS 9.8, django)
- [CVE-2024-11406](https://cve.now/CVE-2024-11406.md): Stored XSS in django CMS Attributes Fields (CVSS 6.9, django CMS Association django CMS Attributes Fields · djang…)
- [CVE-2024-11404](https://cve.now/CVE-2024-11404.md): File Upload Bypass in django Filer (CVSS 5.5, django CMS Association django Filer · django-filer)
- [CVE-2024-11319](https://cve.now/CVE-2024-11319.md): Stored XSS in Open Source Project "django-cms" (CVSS 4.8, django CMS Association django-cms · django-cms)
- [CVE-2024-45230](https://cve.now/CVE-2024-45230.md): An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. (CVSS 7.5, django)
- [CVE-2024-45231](https://cve.now/CVE-2024-45231.md): An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. (CVSS 5.3, django)
- [CVE-2024-41989](https://cve.now/CVE-2024-41989.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 7.5, django)
- [CVE-2024-41990](https://cve.now/CVE-2024-41990.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 7.5, django)
- [CVE-2024-41991](https://cve.now/CVE-2024-41991.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 7.5, django)
- [CVE-2024-42005](https://cve.now/CVE-2024-42005.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 9.8, django)
- [CVE-2024-38875](https://cve.now/CVE-2024-38875.md): An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. (CVSS 7.5, django)
- [CVE-2024-39329](https://cve.now/CVE-2024-39329.md): An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. (CVSS 5.3, django)
- [CVE-2024-39330](https://cve.now/CVE-2024-39330.md): An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. (CVSS 4.3, django)
- [CVE-2024-39614](https://cve.now/CVE-2024-39614.md): An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. (CVSS 7.5, django)
- [CVE-2024-28865](https://cve.now/CVE-2024-28865.md): django-wiki denial of service via regular expression (CVSS 7.5, django-wiki · wiki)
- [CVE-2024-27351](https://cve.now/CVE-2024-27351.md): In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and th (CVSS 5.3, django)
- [CVE-2024-2319](https://cve.now/CVE-2024-2319.md): Cross-Site Scripting vulnerability in Django MarkdownX (CVSS 5.4, Django MarkdownX · django-markdownx)
- [CVE-2024-24680](https://cve.now/CVE-2024-24680.md): An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. (CVSS 7.5, django)
- [CVE-2023-41164](https://cve.now/CVE-2023-41164.md): In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri\_to\_iri() is subject to a potential DoS (deni (no CVSS, django)
- [CVE-2023-43665](https://cve.now/CVE-2023-43665.md): In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used (no CVSS, django)
- [CVE-2023-46695](https://cve.now/CVE-2023-46695.md): An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. (no CVSS, django)
- [CVE-2023-36053](https://cve.now/CVE-2023-36053.md): In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regula (CVSS 7.5, django)
- [CVE-2023-33185](https://cve.now/CVE-2023-33185.md): Incorrect signature verification in django-ses (CVSS 4.6, django-ses)
- [CVE-2023-31047](https://cve.now/CVE-2023-31047.md): In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploa (CVSS 9.8, django)
- [CVE-2017-20182](https://cve.now/CVE-2017-20182.md): Mobile Vikings Django AJAX Utilities Backslash pagination.js Pagination cross site scripting (CVSS 3.5, Mobile Vikings Django AJAX Utilities · django-ajax-utilities)
- [CVE-2023-24580](https://cve.now/CVE-2023-24580.md): An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. (CVSS 7.5, django)
- [CVE-2023-23969](https://cve.now/CVE-2023-23969.md): In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avo (CVSS 7.5, django)
- [CVE-2016-15010](https://cve.now/CVE-2016-15010.md): University of Cambridge django-ucamlookup Lookup cross site scripting (CVSS 3.5, University of Cambridge django-ucamlookup · django-ucamlook…)
- [CVE-2022-4595](https://cve.now/CVE-2022-4595.md): django-openipam exposed\_hosts.html cross site scripting (CVSS 3.5, django-openipam)
- [CVE-2022-4526](https://cve.now/CVE-2022-4526.md): django-photologue Default Template photo\_detail.html cross site scripting (CVSS 3.5, django-photologue)
- [CVE-2022-41323](https://cve.now/CVE-2022-41323.md): In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service at (CVSS 7.5, django)
- [CVE-2022-36359](https://cve.now/CVE-2022-36359.md): An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. (no CVSS, django)
- [CVE-2022-34265](https://cve.now/CVE-2022-34265.md): An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. (no CVSS, django)
- [CVE-2022-24840](https://cve.now/CVE-2022-24840.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3file (CVSS 9.1, codingjoe django-s3file · django-s3file)
- [CVE-2022-24857](https://cve.now/CVE-2022-24857.md): Multi factor authentication bypass in django-mfa3 (CVSS 7.3, xi django-mfa3 · django-mfa3)
- [CVE-2022-28346](https://cve.now/CVE-2022-28346.md): An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. (no CVSS, django)
- [CVE-2022-28347](https://cve.now/CVE-2022-28347.md): A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. (no CVSS, django)
- [CVE-2022-22818](https://cve.now/CVE-2022-22818.md): The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current conte (no CVSS, django)
- [CVE-2022-23833](https://cve.now/CVE-2022-23833.md): An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. (no CVSS, django)
- [CVE-2021-45115](https://cve.now/CVE-2021-45115.md): An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. (no CVSS, django)
- [CVE-2021-45116](https://cve.now/CVE-2021-45116.md): An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. (CVSS 7.5, django)
- [CVE-2021-45452](https://cve.now/CVE-2021-45452.md): Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are direct (no CVSS, django)
- [CVE-2021-44420](https://cve.now/CVE-2021-44420.md): In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream a (no CVSS, django)
- [CVE-2021-3994](https://cve.now/CVE-2021-3994.md): Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk (CVSS 8.8, django-helpdesk/django-helpdesk · django-helpdesk)
- [CVE-2021-25986](https://cve.now/CVE-2021-25986.md): Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section (CVSS 5.4, Django-wiki · wiki)
- [CVE-2021-3950](https://cve.now/CVE-2021-3950.md): Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk (CVSS 8.8, django-helpdesk/django-helpdesk · django-helpdesk)
- [CVE-2021-3945](https://cve.now/CVE-2021-3945.md): Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk (CVSS 8.8, django-helpdesk/django-helpdesk · django-helpdesk)
- [CVE-2021-35042](https://cve.now/CVE-2021-35042.md): Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order\_by SQL injection if order\_by is untrusted input from a client of a w (no CVSS, django)
- [CVE-2021-33203](https://cve.now/CVE-2021-33203.md): Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. (no CVSS, django)
- [CVE-2021-33571](https://cve.now/CVE-2021-33571.md): In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate\_ipv4\_address, and validate\_ipv46\_address do not (no CVSS, django)
- [CVE-2021-32052](https://cve.now/CVE-2021-32052.md): In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (no CVSS, django)
- [CVE-2021-31542](https://cve.now/CVE-2021-31542.md): In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversa (no CVSS, django)
- [CVE-2020-15225](https://cve.now/CVE-2020-15225.md): Denial of Service vulnerability in django-filter (CVSS 7.5, carltongibson django-filter · django-filter)
- [CVE-2021-28658](https://cve.now/CVE-2021-28658.md): In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with su (no CVSS, django)
- [CVE-2021-21416](https://cve.now/CVE-2021-21416.md): Potential sensitive information disclosed in error reports (CVSS 3.7, ubernostrum django-registration · django-registration)
- [CVE-2021-23336](https://cve.now/CVE-2021-23336.md): Web Cache Poisoning (CVSS 5.9, python/cpython · django +3)
- [CVE-2021-3281](https://cve.now/CVE-2021-3281.md): In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" (no CVSS, django)
- [CVE-2020-25626](https://cve.now/CVE-2020-25626.md): A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. (no CVSS, Django REST Framework · djangorestframework)
- [CVE-2020-24584](https://cve.now/CVE-2020-24584.md): An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). (no CVSS, django)
- [CVE-2020-24583](https://cve.now/CVE-2020-24583.md): An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). (no CVSS, django)
- [CVE-2020-15105](https://cve.now/CVE-2020-15105.md): In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session (CVSS 5.4, Bouke django-two-factor-auth · django-two-factor-auth)
- [CVE-2020-4071](https://cve.now/CVE-2020-4071.md): Timing attack on django-basic-auth-ip-whitelist (CVSS 2.2, tm-kn django-basic-auth-ip-whitelist · django-basic-auth-ip…)
- [CVE-2020-13596](https://cve.now/CVE-2020-13596.md): An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. (no CVSS, django)
- [CVE-2020-13254](https://cve.now/CVE-2020-13254.md): An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. (no CVSS, django)
- [CVE-2020-9402](https://cve.now/CVE-2020-9402.md): Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter (no CVSS, django)
- [CVE-2020-7471](https://cve.now/CVE-2020-7471.md): Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (no CVSS, django)
- [CVE-2020-5224](https://cve.now/CVE-2020-5224.md): Session key exposure through session list in Django User Sessions (CVSS 6.5, Jazzband django-user-sessions · django-user-sessions)
- [CVE-2019-19844](https://cve.now/CVE-2019-19844.md): Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. (no CVSS, django)
- [CVE-2019-19118](https://cve.now/CVE-2019-19118.md): Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. (no CVSS, django)
- [CVE-2019-14234](https://cve.now/CVE-2019-14234.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (no CVSS, django)
- [CVE-2019-14235](https://cve.now/CVE-2019-14235.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (no CVSS, django)
- [CVE-2019-14233](https://cve.now/CVE-2019-14233.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (no CVSS, django)
- [CVE-2019-14232](https://cve.now/CVE-2019-14232.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (CVSS 7.5, django)
- [CVE-2019-12781](https://cve.now/CVE-2019-12781.md): An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. (no CVSS, django)
- [CVE-2019-12308](https://cve.now/CVE-2019-12308.md): An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. (no CVSS, django)
- [CVE-2019-11358](https://cve.now/CVE-2019-11358.md): jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototyp (no CVSS, jquery · jquery-rails +4)
- [CVE-2019-6975](https://cve.now/CVE-2019-6975.md): Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-su (no CVSS, django)
- [CVE-2019-3498](https://cve.now/CVE-2019-3498.md): In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used (no CVSS, django)
- [CVE-2018-16984](https://cve.now/CVE-2018-16984.md): An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. (no CVSS, django)
- [CVE-2018-14574](https://cve.now/CVE-2018-14574.md): django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. (no CVSS, django)
- [CVE-2018-7537](https://cve.now/CVE-2018-7537.md): An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. (no CVSS, django)
- [CVE-2018-7536](https://cve.now/CVE-2018-7536.md): An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. (no CVSS, django)
- [CVE-2018-6188](https://cve.now/CVE-2018-6188.md): django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentiall (no CVSS, django)
- [CVE-2017-12794](https://cve.now/CVE-2017-12794.md): In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 d (no CVSS, django)
- [CVE-2017-7233](https://cve.now/CVE-2017-7233.md): Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on succes (no CVSS, django)
- [CVE-2017-7234](https://cve.now/CVE-2017-7234.md): A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the \`\`django.views.static.se (no CVSS, django)
- [CVE-2016-9013](https://cve.now/CVE-2016-9013.md): Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whe (no CVSS, django)
- [CVE-2016-9014](https://cve.now/CVE-2016-9014.md): Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to con (no CVSS, django)
- [CVE-2016-7401](https://cve.now/CVE-2016-7401.md): The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers (no CVSS, django)
- [CVE-2016-6186](https://cve.now/CVE-2016-6186.md): Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjec (no CVSS, django)
- [CVE-2016-2512](https://cve.now/CVE-2016-2512.md): The utils.http.is\_safe\_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary we (no CVSS, django)
- [CVE-2016-2513](https://cve.now/CVE-2016-2513.md): The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via (no CVSS, django)
- [CVE-2016-2048](https://cve.now/CVE-2016-2048.md): Django 1.9.x before 1.9.2, when ModelAdmin.save\_as is set to True, allows remote authenticated users to bypass intended access restrictions (no CVSS, django)
- [CVE-2015-8213](https://cve.now/CVE-2015-8213.md): The get\_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow re (no CVSS, django)
- [CVE-2015-5963](https://cve.now/CVE-2015-5963.md): contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other ver (no CVSS, django)
- [CVE-2015-5964](https://cve.now/CVE-2015-5964.md): The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache\_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x (no CVSS, django)
- [CVE-2015-5143](https://cve.now/CVE-2015-5143.md): The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cau (no CVSS, django)
- [CVE-2015-5144](https://cve.now/CVE-2015-5144.md): Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows rem (no CVSS, django)
- [CVE-2015-5145](https://cve.now/CVE-2015-5145.md): validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified (no CVSS, django)
- [CVE-2015-3982](https://cve.now/CVE-2015-3982.md): The session.flush function in the cached\_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote at (no CVSS, django)
- [CVE-2015-2316](https://cve.now/CVE-2015-2316.md): The utils.html.strip\_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of (no CVSS, django)
- [CVE-2015-2317](https://cve.now/CVE-2015-2317.md): The utils.http.is\_safe\_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not (no CVSS, django)
- [CVE-2015-2241](https://cve.now/CVE-2015-2241.md): Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows rem (no CVSS, django)
- [CVE-2015-0219](https://cve.now/CVE-2015-0219.md): Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an \_ (underscore) c (no CVSS, django)
- [CVE-2015-0220](https://cve.now/CVE-2015-0220.md): The django.util.http.is\_safe\_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle lead (no CVSS, django)
- [CVE-2015-0221](https://cve.now/CVE-2015-0221.md): The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time (no CVSS, django)
- [CVE-2015-0222](https://cve.now/CVE-2015-0222.md): ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show\_hidden\_initial is set to True, allows remote attack (no CVSS, django)
- [CVE-2014-0480](https://cve.now/CVE-2014-0480.md): The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 d (no CVSS, django)
- [CVE-2014-0481](https://cve.now/CVE-2014-0481.md): The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 befor (no CVSS, django)
- [CVE-2014-0482](https://cve.now/CVE-2014-0482.md): The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before (no CVSS, django)
- [CVE-2014-0483](https://cve.now/CVE-2014-0483.md): The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candida (no CVSS, django)
- [CVE-2014-1418](https://cve.now/CVE-2014-1418.md): Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cac (no CVSS, django)
- [CVE-2014-3730](https://cve.now/CVE-2014-3730.md): The django.util.http.is\_safe\_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not pro (no CVSS, django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/django
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.