Djangoproject vulnerabilities
52 CVEs and advisories name Djangoproject as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-4277Privilege abuse in GenericInlineModelAdmin
- CVE-2026-3902ASGI header spoofing via underscore/hyphen conflation
- CVE-2026-25674Potential incorrect permissions on newly created file system objects
- CVE-2026-25673Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
- CVE-2025-14550Potential denial-of-service vulnerability via repeated headers when using ASGI
- CVE-2026-1312Potential SQL injection via QuerySet.order_by and FilteredRelation
- CVE-2026-1287Potential SQL injection in column aliases via control characters
- CVE-2026-1285Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
- CVE-2026-1207Potential SQL injection via raster lookups on PostGIS
- CVE-2025-13473Username enumeration through timing difference in mod_wsgi authentication handler
- CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extraction
- CVE-2025-13372Potential SQL injection in FilteredRelation column aliases on PostgreSQL
- CVE-2025-64459Potential SQL injection via _connector keyword argument in QuerySet and Q objects
- CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
- CVE-2025-59682An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.
- CVE-2025-59681An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.
- CVE-2025-57833An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.
- CVE-2025-48432An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23.
- CVE-2025-32873An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.
- CVE-2025-27556An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14.
- CVE-2025-26699An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20.
- CVE-2024-56374An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18.