Djangoproject vulnerabilities
52 CVEs and advisories name Djangoproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114582Server-side request forgery via SpatialReference string input
- CVE-2026-113733Password hash disclosure to "view only" admin users with custom user models
- CVE-2026-113593Potential exposure of private data via empty and missing Vary headers
- CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometries
- CVE-2026-111211Potential log injection via unescaped geometry form values
- CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file upload
- CVE-2026-87975Privilege abuse in model formsets with editable primary keys
- CVE-2026-87890Potential request forgery via spatial lookup byte values
- CVE-2026-84429Potential denial-of-service vulnerability in HTTP header parsing
- CVE-2026-77050Potential denial-of-service vulnerability in get_supported_language_variant()
- CVE-2026-15920Potential cross-site scripting via URLField values in the admin
- CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collections
- CVE-2026-15337Potential denial-of-service vulnerability in check_for_language()
- CVE-2026-15307Server-side file-write and request forgery via spatial lookups
- CVE-2026-53878Header injection possibility since DomainNameValidator accepted newlines in input
- CVE-2026-53877Heap buffer over-read in GDALRaster
- CVE-2026-48588Potential exposure of private data via cached Set-Cookie response
- CVE-2026-44546Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing
- CVE-2026-44545Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
- CVE-2026-48587Potential exposure of private data via whitespace padding in Vary header
- CVE-2026-35193Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
- CVE-2026-8404Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
- CVE-2026-7666Potential unencrypted email transmission via STARTTLS in the SMTP backend
- CVE-2026-6873Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie
- CVE-2026-35192Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
- CVE-2026-6907Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
- CVE-2026-5766Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
- CVE-2026-33034Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
- CVE-2026-33033Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
- CVE-2026-4292Privilege abuse in ModelAdmin.list_editable