Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/46373?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/46373?format=api", "purl": "pkg:pypi/django@5.2.7", "type": "pypi", "namespace": "", "name": "django", "version": "5.2.7", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.2.14", "latest_non_vulnerable_version": "6.0.5", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37199?format=api", "vulnerability_id": "VCID-4kcg-gx5y-cuaw", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nRaster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1207", "reference_id": "CVE-2026-1207", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1207" }, { "reference_url": "https://github.com/advisories/GHSA-mwm9-4648-f68q", "reference_id": "GHSA-mwm9-4648-f68q", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mwm9-4648-f68q" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1207", "GHSA-mwm9-4648-f68q", "PYSEC-2026-44" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4kcg-gx5y-cuaw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37152?format=api", "vulnerability_id": "VCID-7c5n-nzwk-v7bz", "summary": "An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\n`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf" }, { "reference_url": "https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0" }, { "reference_url": "https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e" }, { "reference_url": "https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355" }, { "reference_url": "https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13372", "reference_id": "CVE-2025-13372", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13372" }, { "reference_url": "https://github.com/advisories/GHSA-rqw2-ghq9-44m7", "reference_id": "GHSA-rqw2-ghq9-44m7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-rqw2-ghq9-44m7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46603?format=api", "purl": "pkg:pypi/django@5.2.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9" } ], "aliases": [ "CVE-2025-13372", "GHSA-rqw2-ghq9-44m7", "PYSEC-2025-104" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7c5n-nzwk-v7bz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37310?format=api", "vulnerability_id": "VCID-abpe-htm1-9ubp", "summary": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50019?format=api", "purl": "pkg:pypi/django@5.2.14", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/50020?format=api", "purl": "pkg:pypi/django@6.0.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.5" } ], "aliases": [ "CVE-2026-35192", "PYSEC-2026-50" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-abpe-htm1-9ubp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37312?format=api", "vulnerability_id": "VCID-eqsc-axng-ckca", "summary": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\n`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmad Sadeddin for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50019?format=api", "purl": "pkg:pypi/django@5.2.14", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/50020?format=api", "purl": "pkg:pypi/django@6.0.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.5" } ], "aliases": [ "CVE-2026-6907", "PYSEC-2026-55" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-eqsc-axng-ckca" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37153?format=api", "vulnerability_id": "VCID-fcg9-xypn-ykhf", "summary": "An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b" }, { "reference_url": "https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5" }, { "reference_url": "https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0" }, { "reference_url": "https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/dec/02/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64460", "reference_id": "CVE-2025-64460", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64460" }, { "reference_url": "https://github.com/advisories/GHSA-vrcr-9hj9-jcg6", "reference_id": "GHSA-vrcr-9hj9-jcg6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vrcr-9hj9-jcg6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46603?format=api", "purl": "pkg:pypi/django@5.2.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9" } ], "aliases": [ "CVE-2025-64460", "GHSA-vrcr-9hj9-jcg6", "PYSEC-2025-109" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fcg9-xypn-ykhf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37140?format=api", "vulnerability_id": "VCID-ga69-9y5g-77c3", "summary": "An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nNFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242" }, { "reference_url": "https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac" }, { "reference_url": "https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f" }, { "reference_url": "https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64458", "reference_id": "CVE-2025-64458", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64458" }, { "reference_url": "https://github.com/advisories/GHSA-qw25-v68c-qjf3", "reference_id": "GHSA-qw25-v68c-qjf3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qw25-v68c-qjf3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46433?format=api", "purl": "pkg:pypi/django@5.2.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.8" } ], "aliases": [ "CVE-2025-64458", "GHSA-qw25-v68c-qjf3", "PYSEC-2025-107" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ga69-9y5g-77c3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37269?format=api", "vulnerability_id": "VCID-ga7z-wj4j-63h1", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nASGI requests with a missing or understated `Content-Length` header could\nbypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading\n`HttpRequest.body`, allowing remote attackers to load an unbounded request body into\nmemory.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Superior for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-33034", "PYSEC-2026-49" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ga7z-wj4j-63h1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37197?format=api", "vulnerability_id": "VCID-jybd-p65h-xffy", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13473", "reference_id": "CVE-2025-13473", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13473" }, { "reference_url": "https://github.com/advisories/GHSA-2mcm-79hx-8fxw", "reference_id": "GHSA-2mcm-79hx-8fxw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-2mcm-79hx-8fxw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2025-13473", "GHSA-2mcm-79hx-8fxw", "PYSEC-2026-42" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jybd-p65h-xffy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37271?format=api", "vulnerability_id": "VCID-kxdd-yzp3-r7cb", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank N05ec@LZU-DSLab for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-4277", "PYSEC-2026-52" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kxdd-yzp3-r7cb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37311?format=api", "vulnerability_id": "VCID-m4am-h2ea-3ffr", "summary": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.\n \nAs a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kyle Agronick for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "url": "https://www.djangoproject.com/weblog/2026/may/05/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50019?format=api", "purl": "pkg:pypi/django@5.2.14", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.14" }, { "url": "http://public2.vulnerablecode.io/api/packages/50020?format=api", "purl": "pkg:pypi/django@6.0.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.5" } ], "aliases": [ "CVE-2026-5766", "PYSEC-2026-54" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m4am-h2ea-3ffr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37270?format=api", "vulnerability_id": "VCID-phkp-9abp-f3dq", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-3902", "PYSEC-2026-51" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-phkp-9abp-f3dq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37198?format=api", "vulnerability_id": "VCID-r1vx-vv7d-gqaj", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Jiyong Yang for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14550", "reference_id": "CVE-2025-14550", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14550" }, { "reference_url": "https://github.com/advisories/GHSA-33mw-q7rj-mjwj", "reference_id": "GHSA-33mw-q7rj-mjwj", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-33mw-q7rj-mjwj" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2025-14550", "GHSA-33mw-q7rj-mjwj", "PYSEC-2026-43" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r1vx-vv7d-gqaj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37200?format=api", "vulnerability_id": "VCID-shch-yusm-1uck", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1285", "reference_id": "CVE-2026-1285", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1285" }, { "reference_url": "https://github.com/advisories/GHSA-4rrr-2h4v-f3j9", "reference_id": "GHSA-4rrr-2h4v-f3j9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-4rrr-2h4v-f3j9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1285", "GHSA-4rrr-2h4v-f3j9", "PYSEC-2026-45" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-shch-yusm-1uck" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37202?format=api", "vulnerability_id": "VCID-shjc-2j68-2yfy", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84" }, { "reference_url": "https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1312", "reference_id": "CVE-2026-1312", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1312" }, { "reference_url": "https://github.com/advisories/GHSA-6426-9fv3-65x8", "reference_id": "GHSA-6426-9fv3-65x8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-6426-9fv3-65x8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1312", "GHSA-6426-9fv3-65x8", "PYSEC-2026-47" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-shjc-2j68-2yfy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37272?format=api", "vulnerability_id": "VCID-tktt-vg92-6kae", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-4292", "PYSEC-2026-53" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tktt-vg92-6kae" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37268?format=api", "vulnerability_id": "VCID-tuqc-c251-h7ds", "summary": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/49222?format=api", "purl": "pkg:pypi/django@5.2.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/49223?format=api", "purl": "pkg:pypi/django@6.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4" } ], "aliases": [ "CVE-2026-33033", "PYSEC-2026-48" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tuqc-c251-h7ds" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37201?format=api", "vulnerability_id": "VCID-wa3g-27sx-mbcw", "summary": "An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://www.djangoproject.com/weblog/2026/feb/03/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1287", "reference_id": "CVE-2026-1287", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1287" }, { "reference_url": "https://github.com/advisories/GHSA-gvg8-93h5-g6qq", "reference_id": "GHSA-gvg8-93h5-g6qq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-gvg8-93h5-g6qq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/47228?format=api", "purl": "pkg:pypi/django@5.2.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/47229?format=api", "purl": "pkg:pypi/django@6.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2" } ], "aliases": [ "CVE-2026-1287", "GHSA-gvg8-93h5-g6qq", "PYSEC-2026-46" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wa3g-27sx-mbcw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37141?format=api", "vulnerability_id": "VCID-whgc-pt2s-77ar", "summary": "An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.\nThe methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank cyberstan for reporting this issue.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85" }, { "reference_url": "https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4" }, { "reference_url": "https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b" }, { "reference_url": "https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241" }, { "reference_url": "https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/omarkurt/django-connector-CVE-2025-64459-testbed" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://www.djangoproject.com/weblog/2025/nov/05/security-releases/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64459", "reference_id": "CVE-2025-64459", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64459" }, { "reference_url": "https://github.com/advisories/GHSA-frmv-pr5f-9mcr", "reference_id": "GHSA-frmv-pr5f-9mcr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-frmv-pr5f-9mcr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46433?format=api", "purl": "pkg:pypi/django@5.2.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.8" } ], "aliases": [ "CVE-2025-64459", "GHSA-frmv-pr5f-9mcr", "PYSEC-2025-108" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-whgc-pt2s-77ar" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37129?format=api", "vulnerability_id": "VCID-5xtt-au84-zbb2", "summary": "An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://docs.djangoproject.com/en/dev/releases/security/" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a" }, { "reference_url": "https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/10/01/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "http://www.openwall.com/lists/oss-security/2025/10/01/3" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59681", "reference_id": "CVE-2025-59681", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59681" }, { "reference_url": "https://github.com/advisories/GHSA-hpr9-3m2g-3j9p", "reference_id": "GHSA-hpr9-3m2g-3j9p", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hpr9-3m2g-3j9p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46371?format=api", "purl": "pkg:pypi/django@4.2.25", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.25" }, { "url": "http://public2.vulnerablecode.io/api/packages/46372?format=api", "purl": "pkg:pypi/django@5.1.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/46373?format=api", "purl": "pkg:pypi/django@5.2.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.7" } ], "aliases": [ "CVE-2025-59681", "GHSA-hpr9-3m2g-3j9p", "PYSEC-2025-106" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5xtt-au84-zbb2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47923?format=api", "vulnerability_id": "VCID-n2v7-jqjy-37bc", "summary": "Django vulnerable to partial directory traversal via archives\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.", "references": [ { "reference_url": "https://docs.djangoproject.com/en/dev/releases/security", "reference_id": "", "reference_type": "", "scores": [], "url": "https://docs.djangoproject.com/en/dev/releases/security" }, { "reference_url": "https://github.com/django/django", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django" }, { "reference_url": "https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e" }, { "reference_url": "https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2" }, { "reference_url": "https://groups.google.com/g/django-announce", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/g/django-announce" }, { "reference_url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.djangoproject.com/weblog/2025/oct/01/security-releases" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59682", "reference_id": "CVE-2025-59682", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59682" }, { "reference_url": "https://github.com/advisories/GHSA-q95w-c7qg-hrff", "reference_id": "GHSA-q95w-c7qg-hrff", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-q95w-c7qg-hrff" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46371?format=api", "purl": "pkg:pypi/django@4.2.25", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.25" }, { "url": "http://public2.vulnerablecode.io/api/packages/46372?format=api", "purl": "pkg:pypi/django@5.1.13", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/46373?format=api", "purl": "pkg:pypi/django@5.2.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-4kcg-gx5y-cuaw" }, { "vulnerability": "VCID-7c5n-nzwk-v7bz" }, { "vulnerability": "VCID-abpe-htm1-9ubp" }, { "vulnerability": "VCID-eqsc-axng-ckca" }, { "vulnerability": "VCID-fcg9-xypn-ykhf" }, { "vulnerability": "VCID-ga69-9y5g-77c3" }, { "vulnerability": "VCID-ga7z-wj4j-63h1" }, { "vulnerability": "VCID-jybd-p65h-xffy" }, { "vulnerability": "VCID-kxdd-yzp3-r7cb" }, { "vulnerability": "VCID-m4am-h2ea-3ffr" }, { "vulnerability": "VCID-phkp-9abp-f3dq" }, { "vulnerability": "VCID-r1vx-vv7d-gqaj" }, { "vulnerability": "VCID-shch-yusm-1uck" }, { "vulnerability": "VCID-shjc-2j68-2yfy" }, { "vulnerability": "VCID-tktt-vg92-6kae" }, { "vulnerability": "VCID-tuqc-c251-h7ds" }, { "vulnerability": "VCID-wa3g-27sx-mbcw" }, { "vulnerability": "VCID-whgc-pt2s-77ar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.7" } ], "aliases": [ "CVE-2025-59682", "GHSA-q95w-c7qg-hrff" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n2v7-jqjy-37bc" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.7" }