Latest vulnerabilities for vendor "djangoproject"

Where

Sort:

Software

djangoproject django

djangoproject daphne

djangoproject DjangoHeader injection possibility since DomainNameValidator accepted newlines in input

Risk 40

Severity

5.3

First published (updated )

CVE-2026-53878

djangoproject DjangoHeap buffer over-read in GDALRaster

Risk 39

Severity

6.3

First published (updated )

CVE-2026-53877

Django DjangoPotential exposure of private data via cached Set-Cookie response

Risk 28

Severity

2.3

First published (updated )

CVE-2026-48588

pypi/daphneHeader injection via WebSocket upgrade parser differential allows ASGI scope header spoofing

Risk 27

Severity

5.3

First published (updated )

CVE-2026-44546

pypi/daphneUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

Risk 43

Severity

7.5

First published (updated )

CVE-2026-44545

djangoproject DjangoPotential exposure of private data via whitespace padding in Vary header

Risk 28

Severity

2.3

First published (updated )

CVE-2026-48587

djangoproject DjangoPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

Risk 18

Severity

2.3

First published (updated )

CVE-2026-35193

djangoproject DjangoPotential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

Risk 20

Severity

2.3

EPSS

0.30%

First published (updated )

CVE-2026-8404

djangoproject DjangoPotential unencrypted email transmission via STARTTLS in the SMTP backend

Risk 18

Severity

2.3

First published (updated )

CVE-2026-7666

djangoproject DjangoSigned cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie

Risk 24

Severity

2.3

First published (updated )

CVE-2026-6873

Django DjangoSession fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

Risk 39

Severity

2.3

First published (updated )

CVE-2026-35192

djangoproject DjangoPotential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

Risk 20

Severity

2.3

EPSS

0.03%

First published (updated )

CVE-2026-6907

djangoproject DjangoPotential denial-of-service vulnerability in ASGI requests via file upload limit bypass

Risk 30

Severity

6.3

First published (updated )

CVE-2026-5766

pip/DjangoPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

Risk 46

Severity

7.5

First published (updated )

CVE-2026-33034

pip/DjangoPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Risk 40

Severity

6.5

First published (updated )

CVE-2026-33033

pip/DjangoPrivilege abuse in ModelAdmin.list_editable

Risk 12

Severity

2.7

EPSS

0.01%

First published (updated )

CVE-2026-4292

pip/DjangoPrivilege abuse in GenericInlineModelAdmin

Risk 63

Severity

9.8

EPSS

0.01%

First published (updated )

CVE-2026-4277

pip/DjangoASGI header spoofing via underscore/hyphen conflation

Risk 46

Severity

7.5

First published (updated )

CVE-2026-3902

pypi/djangoPotential incorrect permissions on newly created file system objects

Risk 21

Severity

3.7

First published (updated )

CVE-2026-25674

pypi/djangoPotential denial-of-service vulnerability in URLField via Unicode normalization on Windows

Risk 46

Severity

7.5

First published (updated )

CVE-2026-25673

pip/DjangoPotential denial-of-service vulnerability via repeated headers when using ASGI

Risk 46

Severity

7.5

First published (updated )

CVE-2025-14550

pip/DjangoPotential SQL injection via QuerySet.order_by and FilteredRelation

Risk 79

Severity

8.5

First published (updated )

CVE-2026-1312

pip/DjangoPotential SQL injection in column aliases via control characters

Risk 74

Severity

8.3

First published (updated )

CVE-2026-1287

pip/DjangoPotential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

Risk 46

Severity

7.5

First published (updated )

CVE-2026-1285

pypi/djangoPotential SQL injection via raster lookups on PostGIS

Risk 62

Severity

8.3

First published (updated )

CVE-2026-1207

pip/DjangoUsername enumeration through timing difference in mod_wsgi authentication handler

Risk 34

Severity

5.3

First published (updated )

CVE-2025-13473

pip/DjangoPotential denial-of-service vulnerability in XML serializer text extraction

Risk 46

Severity

7.5

First published (updated )

CVE-2025-64460

pip/DjangoPotential SQL injection in FilteredRelation column aliases on PostgreSQL

Risk 23

Severity

4.3

First published (updated )

CVE-2025-13372

Django DjangoPotential SQL injection via _connector keyword argument in QuerySet and Q objects

Risk 76

Severity

9.1

Exploited

First published (updated )

CVE-2025-64459

pip/djangoPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Risk 46

Severity

7.5

First published (updated )

CVE-2025-64458

Trending

Vendor Risk Score

Software

djangoproject DjangoHeader injection possibility since DomainNameValidator accepted newlines in input

djangoproject DjangoHeap buffer over-read in GDALRaster

Django DjangoPotential exposure of private data via cached Set-Cookie response

pypi/daphneHeader injection via WebSocket upgrade parser differential allows ASGI scope header spoofing

pypi/daphneUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

Don't miss critical vulnerabilities

djangoproject DjangoPotential exposure of private data via whitespace padding in Vary header

djangoproject DjangoPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

djangoproject DjangoPotential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

djangoproject DjangoPotential unencrypted email transmission via STARTTLS in the SMTP backend

djangoproject DjangoSigned cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie

Don't miss critical vulnerabilities

Django DjangoSession fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

djangoproject DjangoPotential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware

djangoproject DjangoPotential denial-of-service vulnerability in ASGI requests via file upload limit bypass

pip/DjangoPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

pip/DjangoPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

Don't miss critical vulnerabilities

pip/DjangoPrivilege abuse in ModelAdmin.list_editable

pip/DjangoPrivilege abuse in GenericInlineModelAdmin

pip/DjangoASGI header spoofing via underscore/hyphen conflation

pypi/djangoPotential incorrect permissions on newly created file system objects

pypi/djangoPotential denial-of-service vulnerability in URLField via Unicode normalization on Windows

Don't miss critical vulnerabilities

pip/DjangoPotential denial-of-service vulnerability via repeated headers when using ASGI

pip/DjangoPotential SQL injection via QuerySet.order_by and FilteredRelation

pip/DjangoPotential SQL injection in column aliases via control characters

pip/DjangoPotential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

pypi/djangoPotential SQL injection via raster lookups on PostGIS

Don't miss critical vulnerabilities

pip/DjangoUsername enumeration through timing difference in mod_wsgi authentication handler

pip/DjangoPotential denial-of-service vulnerability in XML serializer text extraction

pip/DjangoPotential SQL injection in FilteredRelation column aliases on PostgreSQL

Django DjangoPotential SQL injection via _connector keyword argument in QuerySet and Q objects

pip/djangoPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Don't miss critical vulnerabilities

Company

Resources

Contact