TI-2026-13336 CVE-2026-15920 · GHSA-8rmj-xgq5-w9qm
Potential cross-site scripting via URLField values in the admin
Priority LOW 23
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
Vulnerabilities
157 records
TI-2026-13311 CVE-2026-15830 · GHSA-q238-5cxm-5c9h
Potential denial-of-service vulnerability via nested geometry collections
Priority LOW 39
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18.
TI-2026-12909 CVE-2026-15337 · GHSA-2f9m-qhxg-w5v5
Potential denial-of-service vulnerability in check_for_language()
Priority LOW 31
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-12883 CVE-2026-15307 · GHSA-wvqv-fj8w-qmhm
Server-side file-write and request forgery via spatial lookups
Priority MEDIUM 42
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-38874 CVE-2026-53878 · GHSA-8qcx-xf44-272x
Header injection possibility since DomainNameValidator accepted newlines in input
Priority LOW 24
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
TI-2026-38873 CVE-2026-53877 · GHSA-crhf-3pfg-w68w
Heap buffer over-read in GDALRaster
Priority LOW 29
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
TI-2026-35944 CVE-2026-48588 · GHSA-3h9f-r86x-qvjx
Potential exposure of private data via cached Set-Cookie response
Priority LOW 12
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
TI-2026-35943 CVE-2026-48587 · GHSA-923m-gv2p-w5qp
Potential exposure of private data via whitespace padding in Vary header
Priority LOW 12
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
TI-2026-27346 CVE-2026-35193 · GHSA-qpc8-7fxc-cm4p
Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
Priority LOW 12
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
TI-2026-07386 CVE-2026-8404 · GHSA-8cjm-8mp7-r2xf
Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
Priority LOW 12
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
TI-2026-06748 CVE-2026-7666 · GHSA-mm6v-q8q9-pgcf
Potential unencrypted email transmission via STARTTLS in the SMTP backend
Priority LOW 11
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
TI-2026-06029 CVE-2026-6873 · GHSA-h7pc-vwp9-298g
Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie
Priority LOW 12
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
TI-2026-27345 CVE-2026-35192 · GHSA-7h2m-m8vj-598h
Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Priority LOW 13
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
TI-2026-06053 CVE-2026-6907 · GHSA-5hrc-gvxj-w55p
Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
Priority LOW 12
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
TI-2026-05052 CVE-2026-5766 · GHSA-w26r-rmm8-9c29
Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
Priority LOW 28
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
TI-2026-25480 CVE-2026-33034 · GHSA-933h-hp56-hf7m
Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
Priority MEDIUM 40
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
TI-2026-25479 CVE-2026-33033 · GHSA-5mf9-h53q-7mhq
Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
Priority LOW 31
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
TI-2026-03736 CVE-2026-4292 · GHSA-mmwr-2jhp-mc7j
Privilege abuse in ModelAdmin.list_editable
Priority LOW 13
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
TI-2026-03722 CVE-2026-4277 · GHSA-pwjp-ccjc-ghwg
Privilege abuse in GenericInlineModelAdmin
Priority MEDIUM 49
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
TI-2026-03372 CVE-2026-3902 · GHSA-mvfq-ggxm-9mc5
ASGI header spoofing via underscore/hyphen conflation
Priority LOW 39
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
TI-2026-20762 CVE-2026-25674 · GHSA-mjgh-79qc-68w3
Potential incorrect permissions on newly created file system objects
Priority LOW 18
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
TI-2026-20761 CVE-2026-25673 · GHSA-8p8v-wh79-9r56
Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
Priority MEDIUM 40
An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
TI-2025-13292 CVE-2025-14550 · GHSA-33mw-q7rj-mjwj
Potential denial-of-service vulnerability via repeated headers when using ASGI
Priority MEDIUM 41
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
TI-2026-01025 CVE-2026-1312 · GHSA-6426-9fv3-65x8
Potential SQL injection via QuerySet.order_by and FilteredRelation
Priority LOW 26
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
TI-2026-01003 CVE-2026-1287 · GHSA-gvg8-93h5-g6qq
Potential SQL injection in column aliases via control characters
Priority LOW 26
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.