# cve.now: Djangoproject

The newest entries naming Djangoproject as an affected vendor (up to 200), of 52 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-114582](https://cve.now/CVE-2026-114582.md): Server-side request forgery via SpatialReference string input (CVSS 5.3)
- [CVE-2026-113733](https://cve.now/CVE-2026-113733.md): Password hash disclosure to "view only" admin users with custom user models (CVSS 2.2)
- [CVE-2026-113593](https://cve.now/CVE-2026-113593.md): Potential exposure of private data via empty and missing Vary headers (CVSS 3.1)
- [CVE-2026-111362](https://cve.now/CVE-2026-111362.md): Server-side request forgery via crs member of GeoJSON geometries (CVSS 5.3)
- [CVE-2026-111211](https://cve.now/CVE-2026-111211.md): Potential log injection via unescaped geometry form values (CVSS 5.3)
- [CVE-2026-108147](https://cve.now/CVE-2026-108147.md): Potential memory exhaustion in MultiPartParser via base64-encoded file upload (CVSS 5.3)
- [CVE-2026-87975](https://cve.now/CVE-2026-87975.md): Privilege abuse in model formsets with editable primary keys (CVSS 4.3)
- [CVE-2026-87890](https://cve.now/CVE-2026-87890.md): Potential request forgery via spatial lookup byte values (CVSS 5.3)
- [CVE-2026-84429](https://cve.now/CVE-2026-84429.md): Potential denial-of-service vulnerability in HTTP header parsing (CVSS 5.3)
- [CVE-2026-77050](https://cve.now/CVE-2026-77050.md): Potential denial-of-service vulnerability in get\_supported\_language\_variant() (CVSS 5.3)
- [CVE-2026-15920](https://cve.now/CVE-2026-15920.md): Potential cross-site scripting via URLField values in the admin (CVSS 6.1)
- [CVE-2026-15830](https://cve.now/CVE-2026-15830.md): Potential denial-of-service vulnerability via nested geometry collections (CVSS 5.3)
- [CVE-2026-15337](https://cve.now/CVE-2026-15337.md): Potential denial-of-service vulnerability in check\_for\_language() (CVSS 5.3)
- [CVE-2026-15307](https://cve.now/CVE-2026-15307.md): Server-side file-write and request forgery via spatial lookups (CVSS 8.8)
- [CVE-2026-53878](https://cve.now/CVE-2026-53878.md): Header injection possibility since DomainNameValidator accepted newlines in input (CVSS 6.1)
- [CVE-2026-53877](https://cve.now/CVE-2026-53877.md): Heap buffer over-read in GDALRaster (CVSS 4.8)
- [CVE-2026-48588](https://cve.now/CVE-2026-48588.md): Potential exposure of private data via cached Set-Cookie response (CVSS 4.2)
- [CVE-2026-44546](https://cve.now/CVE-2026-44546.md): Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing (CVSS 3.7)
- [CVE-2026-44545](https://cve.now/CVE-2026-44545.md): Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service (CVSS 5.3)
- [CVE-2026-48587](https://cve.now/CVE-2026-48587.md): Potential exposure of private data via whitespace padding in Vary header (CVSS 3.1)
- [CVE-2026-35193](https://cve.now/CVE-2026-35193.md): Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware (CVSS 3.1)
- [CVE-2026-8404](https://cve.now/CVE-2026-8404.md): Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware (CVSS 3.1)
- [CVE-2026-7666](https://cve.now/CVE-2026-7666.md): Potential unencrypted email transmission via STARTTLS in the SMTP backend (CVSS 3.1)
- [CVE-2026-6873](https://cve.now/CVE-2026-6873.md): Signed cookie salt namespace collision in django.http.HttpRequest.get\_signed\_cookie (CVSS 3.1)
- [CVE-2026-35192](https://cve.now/CVE-2026-35192.md): Session fixation via public cached pages and SESSION\_SAVE\_EVERY\_REQUEST (CVSS 2.3)
- [CVE-2026-6907](https://cve.now/CVE-2026-6907.md): Potential exposure of private data due to incorrect handling of Vary: \* in UpdateCacheMiddleware (CVSS 4.3)
- [CVE-2026-5766](https://cve.now/CVE-2026-5766.md): Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (CVSS 5.3)
- [CVE-2026-33034](https://cve.now/CVE-2026-33034.md): Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass (CVSS 7.5)
- [CVE-2026-33033](https://cve.now/CVE-2026-33033.md): Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (CVSS 6.5)
- [CVE-2026-4292](https://cve.now/CVE-2026-4292.md): Privilege abuse in ModelAdmin.list\_editable (CVSS 2.7)
- [CVE-2026-4277](https://cve.now/CVE-2026-4277.md): Privilege abuse in GenericInlineModelAdmin (CVSS 9.8)
- [CVE-2026-3902](https://cve.now/CVE-2026-3902.md): ASGI header spoofing via underscore/hyphen conflation (CVSS 7.5)
- [CVE-2026-25674](https://cve.now/CVE-2026-25674.md): Potential incorrect permissions on newly created file system objects (CVSS 3.7)
- [CVE-2026-25673](https://cve.now/CVE-2026-25673.md): Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows (CVSS 7.5)
- [CVE-2025-14550](https://cve.now/CVE-2025-14550.md): Potential denial-of-service vulnerability via repeated headers when using ASGI (CVSS 7.5)
- [CVE-2026-1312](https://cve.now/CVE-2026-1312.md): Potential SQL injection via QuerySet.order\_by and FilteredRelation (CVSS 5.4)
- [CVE-2026-1287](https://cve.now/CVE-2026-1287.md): Potential SQL injection in column aliases via control characters (CVSS 5.4)
- [CVE-2026-1285](https://cve.now/CVE-2026-1285.md): Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods (CVSS 7.5)
- [CVE-2026-1207](https://cve.now/CVE-2026-1207.md): Potential SQL injection via raster lookups on PostGIS (CVSS 5.4)
- [CVE-2025-13473](https://cve.now/CVE-2025-13473.md): Username enumeration through timing difference in mod\_wsgi authentication handler (CVSS 5.3)
- [CVE-2025-64460](https://cve.now/CVE-2025-64460.md): Potential denial-of-service vulnerability in XML serializer text extraction (CVSS 7.5)
- [CVE-2025-13372](https://cve.now/CVE-2025-13372.md): Potential SQL injection in FilteredRelation column aliases on PostgreSQL (CVSS 4.3)
- [CVE-2025-64459](https://cve.now/CVE-2025-64459.md): Potential SQL injection via \_connector keyword argument in QuerySet and Q objects (CVSS 9.1)
- [CVE-2025-64458](https://cve.now/CVE-2025-64458.md): Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows (CVSS 7.5)
- [CVE-2025-59682](https://cve.now/CVE-2025-59682.md): An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. (CVSS 3.1)
- [CVE-2025-59681](https://cve.now/CVE-2025-59681.md): An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. (CVSS 7.1)
- [CVE-2025-57833](https://cve.now/CVE-2025-57833.md): An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. (CVSS 7.1)
- [CVE-2025-48432](https://cve.now/CVE-2025-48432.md): An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. (CVSS 4.0)
- [CVE-2025-32873](https://cve.now/CVE-2025-32873.md): An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. (CVSS 5.3)
- [CVE-2025-27556](https://cve.now/CVE-2025-27556.md): An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. (CVSS 5.8)
- [CVE-2025-26699](https://cve.now/CVE-2025-26699.md): An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. (CVSS 5.0)
- [CVE-2024-56374](https://cve.now/CVE-2024-56374.md): An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. (CVSS 5.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/djangoproject
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.