Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/44603?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/44603?format=api", "purl": "pkg:pypi/django@4.2.20", "type": "pypi", "namespace": "", "name": "django", "version": "4.2.20", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "4.2.30", "latest_non_vulnerable_version": "6.0.5", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37199?format=api", "vulnerability_id": "VCID-4kcg-gx5y-cuaw", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nRaster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1207", "reference_id": "CVE-2026-1207", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1207" }, { "reference_url": "https://github.com/advisories/GHSA-mwm9-4648-f68q", "reference_id": "GHSA-mwm9-4648-f68q", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mwm9-4648-f68q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47227?format=api", "purl": "pkg:pypi/django@4.2.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1207", "GHSA-mwm9-4648-f68q", "PYSEC-2026-44" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4kcg-gx5y-cuaw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37129?format=api", "vulnerability_id": "VCID-5xtt-au84-zbb2", "summary": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a" }, { "reference_url": "https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/10/01/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "http://www.openwall.com/lists/oss-security/2025/10/01/3" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59681", "reference_id": "CVE-2025-59681", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59681" }, { "reference_url": "https://github.com/advisories/GHSA-hpr9-3m2g-3j9p", "reference_id": "GHSA-hpr9-3m2g-3j9p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hpr9-3m2g-3j9p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46371?format=api", "purl": "pkg:pypi/django@4.2.25", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.25" }, { "url": "http://public2.vulnerablecode.io/api/packages/46372?format=api", "purl": "pkg:pypi/django@5.1.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/46373?format=api", "purl": "pkg:pypi/django@5.2.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.7" } ], "aliases": [ "CVE-2025-59681", "GHSA-hpr9-3m2g-3j9p", "PYSEC-2025-106" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5xtt-au84-zbb2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37152?format=api", "vulnerability_id": "VCID-7c5n-nzwk-v7bz", "summary": "An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\n`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf" }, { "reference_url": "https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0" }, { "reference_url": "https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e" }, { "reference_url": "https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355" }, { "reference_url": "https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13372", "reference_id": "CVE-2025-13372", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13372" }, { "reference_url": "https://github.com/advisories/GHSA-rqw2-ghq9-44m7", "reference_id": "GHSA-rqw2-ghq9-44m7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-rqw2-ghq9-44m7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46601?format=api", "purl": "pkg:pypi/django@4.2.27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.27" }, { "url": "http://public2.vulnerablecode.io/api/packages/46602?format=api", "purl": "pkg:pypi/django@5.1.15", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/46603?format=api", "purl": "pkg:pypi/django@5.2.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9" } ], "aliases": [ "CVE-2025-13372", "GHSA-rqw2-ghq9-44m7", "PYSEC-2025-104" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7c5n-nzwk-v7bz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6802?format=api", "vulnerability_id": "VCID-9kvc-1bdz-n3bd", "summary": "denial of service", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14232", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14232" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41164", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41164" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43665", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43665" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24680", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24680" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27351", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27351" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39329", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39329" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39330", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39330" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39614", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39614" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41989", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41989" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41991", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41991" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42005", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42005" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45231", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45231" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53907", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53907" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56374", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56374" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13372", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13372" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26699", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26699" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32873", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32873" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48432", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48432" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57833", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57833" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59681", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59681" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59682", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59682" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64459", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64459" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64460", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64460" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/may/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/may/07/security-releases/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/05/07/1", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.openwall.com/lists/oss-security/2025/05/07/1" }, { "reference_url": "https://security.archlinux.org/ASA-202505-10", "reference_id": "ASA-202505-10", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202505-10" }, { "reference_url": "https://security.archlinux.org/AVG-2876", "reference_id": "AVG-2876", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2876" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/45039?format=api", "purl": "pkg:pypi/django@4.2.21", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-bb8b-hq41-s7a6" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/45040?format=api", "purl": "pkg:pypi/django@5.1.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-bb8b-hq41-s7a6" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.9" }, { "url": "http://public2.vulnerablecode.io/api/packages/45041?format=api", "purl": "pkg:pypi/django@5.2.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-bb8b-hq41-s7a6" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.1" } ], "aliases": [ "CVE-2025-32873", "PYSEC-2025-37" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9kvc-1bdz-n3bd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37078?format=api", "vulnerability_id": "VCID-bb8b-hq41-s7a6", "summary": "An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/jun/04/security-releases/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/jun/04/security-releases/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/06/04/5", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.openwall.com/lists/oss-security/2025/06/04/5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/45302?format=api", "purl": "pkg:pypi/django@4.2.22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.22" }, { "url": "http://public2.vulnerablecode.io/api/packages/45301?format=api", "purl": "pkg:pypi/django@5.1.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.10" }, { "url": "http://public2.vulnerablecode.io/api/packages/45300?format=api", "purl": "pkg:pypi/django@5.2.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.2" } ], "aliases": [ "CVE-2025-48432", "PYSEC-2025-47" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bb8b-hq41-s7a6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37153?format=api", "vulnerability_id": "VCID-fcg9-xypn-ykhf", "summary": "An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b" }, { "reference_url": "https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5" }, { "reference_url": "https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0" }, { "reference_url": "https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64460", "reference_id": "CVE-2025-64460", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64460" }, { "reference_url": "https://github.com/advisories/GHSA-vrcr-9hj9-jcg6", "reference_id": "GHSA-vrcr-9hj9-jcg6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vrcr-9hj9-jcg6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46601?format=api", "purl": "pkg:pypi/django@4.2.27", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.27" }, { "url": "http://public2.vulnerablecode.io/api/packages/46602?format=api", "purl": "pkg:pypi/django@5.1.15", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.15" }, { "url": "http://public2.vulnerablecode.io/api/packages/46603?format=api", "purl": "pkg:pypi/django@5.2.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9" } ], "aliases": [ "CVE-2025-64460", "GHSA-vrcr-9hj9-jcg6", "PYSEC-2025-109" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fcg9-xypn-ykhf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37140?format=api", "vulnerability_id": "VCID-ga69-9y5g-77c3", "summary": "An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242" }, { "reference_url": "https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac" }, { "reference_url": "https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f" }, { "reference_url": "https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64458", "reference_id": "CVE-2025-64458", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64458" }, { "reference_url": "https://github.com/advisories/GHSA-qw25-v68c-qjf3", "reference_id": "GHSA-qw25-v68c-qjf3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qw25-v68c-qjf3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46431?format=api", "purl": "pkg:pypi/django@4.2.26", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.26" }, { "url": "http://public2.vulnerablecode.io/api/packages/46432?format=api", "purl": "pkg:pypi/django@5.1.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/46433?format=api", "purl": "pkg:pypi/django@5.2.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.8" } ], "aliases": [ "CVE-2025-64458", "GHSA-qw25-v68c-qjf3", "PYSEC-2025-107" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ga69-9y5g-77c3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37269?format=api", "vulnerability_id": "VCID-ga7z-wj4j-63h1", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nASGI requests with a missing or understated `Content-Length` header could\nbypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading\n`HttpRequest.body`, allowing remote attackers to load an unbounded request body into\nmemory.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Superior for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49221?format=api", "purl": "pkg:pypi/django@4.2.30", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-33034", "PYSEC-2026-49" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ga7z-wj4j-63h1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37197?format=api", "vulnerability_id": "VCID-jybd-p65h-xffy", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13473", "reference_id": "CVE-2025-13473", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13473" }, { "reference_url": "https://github.com/advisories/GHSA-2mcm-79hx-8fxw", "reference_id": "GHSA-2mcm-79hx-8fxw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-2mcm-79hx-8fxw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47227?format=api", "purl": "pkg:pypi/django@4.2.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2025-13473", "GHSA-2mcm-79hx-8fxw", "PYSEC-2026-42" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jybd-p65h-xffy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37271?format=api", "vulnerability_id": "VCID-kxdd-yzp3-r7cb", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank N05ec@LZU-DSLab for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49221?format=api", "purl": "pkg:pypi/django@4.2.30", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-4277", "PYSEC-2026-52" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kxdd-yzp3-r7cb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37270?format=api", "vulnerability_id": "VCID-phkp-9abp-f3dq", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49221?format=api", "purl": "pkg:pypi/django@4.2.30", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-3902", "PYSEC-2026-51" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-phkp-9abp-f3dq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37198?format=api", "vulnerability_id": "VCID-r1vx-vv7d-gqaj", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Jiyong Yang for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14550", "reference_id": "CVE-2025-14550", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14550" }, { "reference_url": "https://github.com/advisories/GHSA-33mw-q7rj-mjwj", "reference_id": "GHSA-33mw-q7rj-mjwj", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-33mw-q7rj-mjwj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47227?format=api", "purl": "pkg:pypi/django@4.2.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2025-14550", "GHSA-33mw-q7rj-mjwj", "PYSEC-2026-43" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r1vx-vv7d-gqaj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37200?format=api", "vulnerability_id": "VCID-shch-yusm-1uck", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1285", "reference_id": "CVE-2026-1285", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1285" }, { "reference_url": "https://github.com/advisories/GHSA-4rrr-2h4v-f3j9", "reference_id": "GHSA-4rrr-2h4v-f3j9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-4rrr-2h4v-f3j9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47227?format=api", "purl": "pkg:pypi/django@4.2.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1285", "GHSA-4rrr-2h4v-f3j9", "PYSEC-2026-45" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-shch-yusm-1uck" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37202?format=api", "vulnerability_id": "VCID-shjc-2j68-2yfy", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84" }, { "reference_url": "https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1312", "reference_id": "CVE-2026-1312", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1312" }, { "reference_url": "https://github.com/advisories/GHSA-6426-9fv3-65x8", "reference_id": "GHSA-6426-9fv3-65x8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6426-9fv3-65x8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47227?format=api", "purl": "pkg:pypi/django@4.2.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1312", "GHSA-6426-9fv3-65x8", "PYSEC-2026-47" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-shjc-2j68-2yfy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37272?format=api", "vulnerability_id": "VCID-tktt-vg92-6kae", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49221?format=api", "purl": "pkg:pypi/django@4.2.30", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-4292", "PYSEC-2026-53" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tktt-vg92-6kae" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37268?format=api", "vulnerability_id": "VCID-tuqc-c251-h7ds", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49221?format=api", "purl": "pkg:pypi/django@4.2.30", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.30" }, { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-33033", "PYSEC-2026-48" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tuqc-c251-h7ds" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37201?format=api", "vulnerability_id": "VCID-wa3g-27sx-mbcw", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1287", "reference_id": "CVE-2026-1287", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1287" }, { "reference_url": "https://github.com/advisories/GHSA-gvg8-93h5-g6qq", "reference_id": "GHSA-gvg8-93h5-g6qq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-gvg8-93h5-g6qq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47227?format=api", "purl": "pkg:pypi/django@4.2.28", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.28" }, { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1287", "GHSA-gvg8-93h5-g6qq", "PYSEC-2026-46" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wa3g-27sx-mbcw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37141?format=api", "vulnerability_id": "VCID-whgc-pt2s-77ar", "summary": "An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85" }, { "reference_url": "https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4" }, { "reference_url": "https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b" }, { "reference_url": "https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241" }, { "reference_url": "https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64459", "reference_id": "CVE-2025-64459", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64459" }, { "reference_url": "https://github.com/advisories/GHSA-frmv-pr5f-9mcr", "reference_id": "GHSA-frmv-pr5f-9mcr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-frmv-pr5f-9mcr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46431?format=api", "purl": "pkg:pypi/django@4.2.26", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.26" }, { "url": "http://public2.vulnerablecode.io/api/packages/46432?format=api", "purl": "pkg:pypi/django@5.1.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/46433?format=api", "purl": "pkg:pypi/django@5.2.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.8" } ], "aliases": [ "CVE-2025-64459", "GHSA-frmv-pr5f-9mcr", "PYSEC-2025-108" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-whgc-pt2s-77ar" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37105?format=api", "vulnerability_id": "VCID-ynt9-h6ww-h7e9", "summary": "An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html" }, { "reference_url": "https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://medium.com/@EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/sep/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/sep/03/security-releases/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/09/03/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "http://www.openwall.com/lists/oss-security/2025/09/03/3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46303?format=api", "purl": "pkg:pypi/django@4.2.24", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.24" }, { "url": "http://public2.vulnerablecode.io/api/packages/46304?format=api", "purl": "pkg:pypi/django@5.1.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/46305?format=api", "purl": "pkg:pypi/django@5.2.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.6" } ], "aliases": [ "CVE-2025-57833", "PYSEC-2025-105" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ynt9-h6ww-h7e9" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36984?format=api", "vulnerability_id": "VCID-qy1a-x3ff-4bc8", "summary": "An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00012.html" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/mar/06/security-releases/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/mar/06/security-releases/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/03/06/12", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.openwall.com/lists/oss-security/2025/03/06/12" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44603?format=api", "purl": "pkg:pypi/django@4.2.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-9kvc-1bdz-n3bd" }, { "vulnerability": "VCID-bb8b-hq41-s7a6" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/44602?format=api", "purl": "pkg:pypi/django@5.0.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-qw15-2kq7-wqed" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.0.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/44601?format=api", "purl": "pkg:pypi/django@5.1.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5xtt-au84-zbb2" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-9kvc-1bdz-n3bd" }, { "vulnerability": "VCID-bb8b-hq41-s7a6" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-qw15-2kq7-wqed" }, { "vulnerability": "VCID-whgc-pt2s-77ar" }, { "vulnerability": "VCID-ynt9-h6ww-h7e9" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.7" } ], "aliases": [ "CVE-2025-26699", "PYSEC-2025-13" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qy1a-x3ff-4bc8" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.20" }