TI-2026-84393 CVE-2026-114582 · GHSA-c37w-4pqp-2hm7
Server-side request forgery in Django via SpatialReference string input
Priority LOW 37
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
Vulnerabilities
172 records
TI-2026-84392 CVE-2026-113733 · GHSA-p5cm-h6hp-4g48
Password hash disclosure to view-only admin users in Django
Priority LOW 11
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10.
TI-2026-84391 CVE-2026-113593 · GHSA-rpcg-ffqj-qpjw
Potential exposure of private data via empty and missing Vary headers
Priority LOW 12
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
TI-2026-84390 CVE-2026-111362 · GHSA-gmp6-3w93-2w6x
Server-side request forgery via crs member of GeoJSON geometries
Priority LOW 37
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
TI-2026-84389 CVE-2026-111211 · GHSA-cc89-hg86-h2hx
Log injection via unescaped geometry form values in Django
Priority LOW 31
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
TI-2026-84388 CVE-2026-108147 · GHSA-9v48-h9hx-rjpv
Memory exhaustion in Django MultiPartParser via base64 file uploads
Priority LOW 37
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19.
TI-2026-68441 CVE-2026-87975 · GHSA-x869-hccf-fv7r
Authorization bypass in Django model formsets lets users delete rows
Priority LOW 23
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
TI-2026-68440 CVE-2026-87890 · GHSA-7cqx-w4gp-37v7
Server-side request forgery in Django spatial lookup bytes values
Priority LOW 36
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
TI-2026-68438 CVE-2026-84429 · GHSA-76g2-x83x-73r7
Quadratic parsing in Django HTTP headers allows denial of service
Priority LOW 37
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
TI-2026-68435 CVE-2026-77050 · GHSA-mxcg-2f2x-4q92
Memory exhaustion in Django get_supported_language_variant()
Priority LOW 37
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
TI-2026-13336 CVE-2026-15920 · GHSA-8rmj-xgq5-w9qm
Potential cross-site scripting via URLField values in the admin
Priority LOW 23
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-13311 CVE-2026-15830 · GHSA-q238-5cxm-5c9h
Potential denial-of-service vulnerability via nested geometry collections
Priority LOW 39
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18.
TI-2026-12909 CVE-2026-15337 · GHSA-2f9m-qhxg-w5v5
Potential denial-of-service vulnerability in check_for_language()
Priority LOW 31
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-12883 CVE-2026-15307 · GHSA-wvqv-fj8w-qmhm
Server-side file-write and request forgery via spatial lookups
Priority MEDIUM 42
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-38874 CVE-2026-53878 · GHSA-8qcx-xf44-272x
Header injection possibility since DomainNameValidator accepted newlines in input
Priority LOW 24
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
TI-2026-38873 CVE-2026-53877 · GHSA-crhf-3pfg-w68w
Heap buffer over-read in GDALRaster
Priority LOW 29
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
TI-2026-35944 CVE-2026-48588 · GHSA-3h9f-r86x-qvjx
Potential exposure of private data via cached Set-Cookie response
Priority LOW 12
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
TI-2026-32458 CVE-2026-44546 · GHSA-xh68-hfp5-5x5m
Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing
Priority LOW 23
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing.
TI-2026-32457 CVE-2026-44545 · GHSA-rrc9-mx66-ffcm
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Priority LOW 39
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.
TI-2026-35943 CVE-2026-48587 · GHSA-923m-gv2p-w5qp
Potential exposure of private data via whitespace padding in Vary header
Priority LOW 12
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
TI-2026-27346 CVE-2026-35193 · GHSA-qpc8-7fxc-cm4p
Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
Priority LOW 12
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
TI-2026-07386 CVE-2026-8404 · GHSA-8cjm-8mp7-r2xf
Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
Priority LOW 12
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
TI-2026-06748 CVE-2026-7666 · GHSA-mm6v-q8q9-pgcf
Potential unencrypted email transmission via STARTTLS in the SMTP backend
Priority LOW 11
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
TI-2026-06029 CVE-2026-6873 · GHSA-h7pc-vwp9-298g
Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie
Priority LOW 12
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
TI-2026-27345 CVE-2026-35192 · GHSA-7h2m-m8vj-598h
Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Priority LOW 13
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.