CVE Program partner

DSF

Django Software Foundation

API
CVEs, 365 days3838 all time, 0 rejected
Quality85%median 99%
CVSS by the CNA55%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA44%lower is better
OrganisationDjango Software Foundation
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeOnly supported and end-of-life Django versions available at <a href='https://www.djangoproject.com/download/' target='_blank'>https://www.djangoproject.com/download/</a> and projects listed at <a href='https://github.com/django' target='_blank'>https://github.com/django</a> (such as Django, channels, and daphne), excluding distributions maintained by third-party redistributors.
Advisorieshttps://docs.djangoproject.com/en/stable/releases/security/

Latest CVEs · RSS

  • CVE-2026-87975 2026-10-06 · CVSS 4.3
    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used
  • CVE-2026-87890 2026-10-06 · CVSS 5.3
    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allo
  • CVE-2026-84429 2026-10-06 · CVSS 5.3
    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` was subject to a pote
  • CVE-2026-77050 2026-10-06 · CVSS 5.3
    An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_language_variant()` is subj
  • CVE-2026-15920 2026-08-04 · CVSS 6.1
    An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickabl
  • CVE-2026-15830 2026-08-04 · CVSS 5.3
    An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of
  • CVE-2026-15337 2026-08-04 · CVSS 5.3
    An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-se
  • CVE-2026-15307 2026-08-04 · CVSS 8.8
    An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster b
  • CVE-2026-53878 2026-07-07 · CVSS 6.1
    An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a fo
  • CVE-2026-53877 2026-07-07 · CVSS 4.8
    An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed
  • CVE-2026-48588 2026-07-07 · CVSS 4.2
    An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on
  • CVE-2026-44546 2026-06-03 · CVSS 3.7
    daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not
  • CVE-2026-44545 2026-06-03 · CVSS 5.3
    daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (
  • CVE-2026-48587 2026-06-03 · CVSS 3.1
    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing wh
  • CVE-2026-35193 2026-06-03 · CVSS 3.1
    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization`
  • CVE-2026-8404 2026-06-03 · CVSS 3.1
    An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Contro
  • CVE-2026-7666 2026-06-03 · CVSS 3.1
    An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a pa
  • CVE-2026-6873 2026-06-03 · CVSS 3.1
    An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt deriva
  • CVE-2026-35192 2026-05-05 · CVSS 2.3
    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY
  • CVE-2026-6907 2026-05-05 · CVSS 4.3
    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary`
  • CVE-2026-5766 2026-05-05 · CVSS 5.3
    An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLO
  • CVE-2026-33034 2026-04-07
    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header could
  • CVE-2026-33033 2026-04-07
    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submi
  • CVE-2026-4292 2026-04-07
    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using `ModelAdmin.list_editable` incorrectly allow
  • CVE-2026-4277 2026-04-07
    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submissio

All CVE Program partners