| Fixing_vulnerabilities |
| 0 |
| url |
VCID-3sac-ah8j-pucd |
| vulnerability_id |
VCID-3sac-ah8j-pucd |
| summary |
Django SQL injection in HasKey(lhs, rhs) on Oracle
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-53908 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71795 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71791 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71679 |
| published_at |
2026-04-02T12:55:00Z |
|
| 3 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71741 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71759 |
| published_at |
2026-04-18T12:55:00Z |
|
| 5 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71753 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.7171 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71728 |
| published_at |
2026-04-12T12:55:00Z |
|
| 8 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71745 |
| published_at |
2026-04-11T12:55:00Z |
|
| 9 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.7172 |
| published_at |
2026-04-09T12:55:00Z |
|
| 10 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71709 |
| published_at |
2026-04-08T12:55:00Z |
|
| 11 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.7167 |
| published_at |
2026-04-07T12:55:00Z |
|
| 12 |
| value |
0.00687 |
| scoring_system |
epss |
| scoring_elements |
0.71697 |
| published_at |
2026-04-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-53908 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
7.2 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 6 |
|
| 7 |
| reference_url |
https://groups.google.com/g/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
7.2 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-12-06T16:19:13Z/ |
|
|
| url |
https://groups.google.com/g/django-announce |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-53908, CVE-2024-53908, GHSA-m9g8-fxxm-xg86, PYSEC-2024-157
|
| risk_score |
4.4 |
| exploitability |
0.5 |
| weighted_severity |
8.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3sac-ah8j-pucd |
|
| 1 |
| url |
VCID-4ztz-fq98-5fh1 |
| vulnerability_id |
VCID-4ztz-fq98-5fh1 |
| summary |
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-41164 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61092 |
| published_at |
2026-04-24T12:55:00Z |
|
| 1 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61067 |
| published_at |
2026-04-08T12:55:00Z |
|
| 2 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61025 |
| published_at |
2026-04-02T12:55:00Z |
|
| 3 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61053 |
| published_at |
2026-04-04T12:55:00Z |
|
| 4 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61019 |
| published_at |
2026-04-07T12:55:00Z |
|
| 5 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61103 |
| published_at |
2026-04-21T12:55:00Z |
|
| 6 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.6112 |
| published_at |
2026-04-18T12:55:00Z |
|
| 7 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61113 |
| published_at |
2026-04-16T12:55:00Z |
|
| 8 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61071 |
| published_at |
2026-04-13T12:55:00Z |
|
| 9 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.6109 |
| published_at |
2026-04-12T12:55:00Z |
|
| 10 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61104 |
| published_at |
2026-04-26T12:55:00Z |
|
| 11 |
| value |
0.00406 |
| scoring_system |
epss |
| scoring_elements |
0.61083 |
| published_at |
2026-04-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-41164 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2023-41164, CVE-2023-41164, GHSA-7h4p-27mh-hmrw, PYSEC-2023-225
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4ztz-fq98-5fh1 |
|
| 2 |
| url |
VCID-66w1-4zku-gyfp |
| vulnerability_id |
VCID-66w1-4zku-gyfp |
| summary |
Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45452 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52683 |
| published_at |
2026-04-11T12:55:00Z |
|
| 1 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.5264 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.5263 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52679 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52695 |
| published_at |
2026-04-18T12:55:00Z |
|
| 5 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52688 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.5265 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52666 |
| published_at |
2026-04-12T12:55:00Z |
|
| 8 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52632 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52637 |
| published_at |
2026-04-08T12:55:00Z |
|
| 10 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52586 |
| published_at |
2026-04-07T12:55:00Z |
|
| 11 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.5262 |
| published_at |
2026-04-04T12:55:00Z |
|
| 12 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52593 |
| published_at |
2026-04-02T12:55:00Z |
|
| 13 |
| value |
0.00293 |
| scoring_system |
epss |
| scoring_elements |
0.52549 |
| published_at |
2026-04-01T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45452 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/advisories/GHSA-jrh2-hc4r-7jwx |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-jrh2-hc4r-7jwx |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-45452, CVE-2021-45452, GHSA-jrh2-hc4r-7jwx, PYSEC-2022-3
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-66w1-4zku-gyfp |
|
| 3 |
| url |
VCID-6gss-ppm5-3yc9 |
| vulnerability_id |
VCID-6gss-ppm5-3yc9 |
| summary |
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-36359 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.7387 |
| published_at |
2026-04-09T12:55:00Z |
|
| 1 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73951 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73942 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73873 |
| published_at |
2026-04-12T12:55:00Z |
|
| 4 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73892 |
| published_at |
2026-04-11T12:55:00Z |
|
| 5 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73908 |
| published_at |
2026-04-21T12:55:00Z |
|
| 6 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73916 |
| published_at |
2026-04-18T12:55:00Z |
|
| 7 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73907 |
| published_at |
2026-04-16T12:55:00Z |
|
| 8 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73828 |
| published_at |
2026-04-02T12:55:00Z |
|
| 9 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73852 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73823 |
| published_at |
2026-04-07T12:55:00Z |
|
| 11 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73857 |
| published_at |
2026-04-08T12:55:00Z |
|
| 12 |
| value |
0.00789 |
| scoring_system |
epss |
| scoring_elements |
0.73865 |
| published_at |
2026-04-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-36359 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-36359, CVE-2022-36359, GHSA-8x94-hmjh-97hq, PYSEC-2022-245
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6gss-ppm5-3yc9 |
|
| 4 |
| url |
VCID-7tca-pgcs-cuhd |
| vulnerability_id |
VCID-7tca-pgcs-cuhd |
| summary |
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41323 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.91977 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92024 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92019 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92022 |
| published_at |
2026-04-26T12:55:00Z |
|
| 4 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92025 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92011 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.9201 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92007 |
| published_at |
2026-04-13T12:55:00Z |
|
| 8 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.92003 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.91985 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.07863 |
| scoring_system |
epss |
| scoring_elements |
0.91991 |
| published_at |
2026-04-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-41323 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-41323, CVE-2022-41323, GHSA-qrw5-5h28-6cmg, PYSEC-2022-304
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7tca-pgcs-cuhd |
|
| 5 |
| url |
VCID-7tph-k8q2-bue2 |
| vulnerability_id |
VCID-7tph-k8q2-bue2 |
| summary |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-41991 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75887 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75878 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.7582 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75851 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75813 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75839 |
| published_at |
2026-04-21T12:55:00Z |
|
| 6 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75815 |
| published_at |
2026-04-09T12:55:00Z |
|
| 7 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75803 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.7577 |
| published_at |
2026-04-07T12:55:00Z |
|
| 9 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75792 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75759 |
| published_at |
2026-04-02T12:55:00Z |
|
| 11 |
| value |
0.0091 |
| scoring_system |
epss |
| scoring_elements |
0.75855 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-41991 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T17:57:11Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-41991, CVE-2024-41991, GHSA-r836-hh6v-rg5g, PYSEC-2024-69
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7tph-k8q2-bue2 |
|
| 6 |
| url |
VCID-8xgs-8xjr-cber |
| vulnerability_id |
VCID-8xgs-8xjr-cber |
| summary |
An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-24680 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80446 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80439 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80413 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.8041 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80408 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80379 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80386 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80402 |
| published_at |
2026-04-11T12:55:00Z |
|
| 8 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80383 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80372 |
| published_at |
2026-04-08T12:55:00Z |
|
| 10 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80355 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80335 |
| published_at |
2026-04-02T12:55:00Z |
|
| 12 |
| value |
0.01394 |
| scoring_system |
epss |
| scoring_elements |
0.80343 |
| published_at |
2026-04-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-24680 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.2 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 2 |
| value |
8.2 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 3 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T17:27:36Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-24680, CVE-2024-24680, GHSA-xxj9-f6rv-m3x4, PYSEC-2024-28
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8xgs-8xjr-cber |
|
| 7 |
| url |
VCID-9abh-apwm-ebab |
| vulnerability_id |
VCID-9abh-apwm-ebab |
| summary |
An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags(). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-32873 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.3732 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.3734 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37577 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37659 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37613 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37641 |
| published_at |
2026-04-18T12:55:00Z |
|
| 6 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37674 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37661 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37647 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37596 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37717 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37692 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-32873 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2025-32873, CVE-2025-32873, GHSA-8j24-cjrq-gr2m, PYSEC-2025-37
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9abh-apwm-ebab |
|
| 8 |
| url |
VCID-9k9t-vp1a-z7bt |
| vulnerability_id |
VCID-9k9t-vp1a-z7bt |
| summary |
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-3281 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97088 |
| published_at |
2026-04-07T12:55:00Z |
|
| 1 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97104 |
| published_at |
2026-04-13T12:55:00Z |
|
| 2 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97102 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97098 |
| published_at |
2026-04-09T12:55:00Z |
|
| 4 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97083 |
| published_at |
2026-04-02T12:55:00Z |
|
| 5 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97115 |
| published_at |
2026-04-18T12:55:00Z |
|
| 6 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97076 |
| published_at |
2026-04-01T12:55:00Z |
|
| 7 |
| value |
0.36231 |
| scoring_system |
epss |
| scoring_elements |
0.97112 |
| published_at |
2026-04-16T12:55:00Z |
|
| 8 |
| value |
0.41482 |
| scoring_system |
epss |
| scoring_elements |
0.97418 |
| published_at |
2026-04-26T12:55:00Z |
|
| 9 |
| value |
0.41482 |
| scoring_system |
epss |
| scoring_elements |
0.97416 |
| published_at |
2026-04-24T12:55:00Z |
|
| 10 |
| value |
0.41482 |
| scoring_system |
epss |
| scoring_elements |
0.97415 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-3281 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
https://github.com/advisories/GHSA-fvgf-6h6h-3322 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-fvgf-6h6h-3322 |
|
| 8 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-3281, CVE-2021-3281, GHSA-fvgf-6h6h-3322, PYSEC-2021-9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9k9t-vp1a-z7bt |
|
| 9 |
| url |
VCID-c8s7-3g9m-d3cw |
| vulnerability_id |
VCID-c8s7-3g9m-d3cw |
| summary |
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) . |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-33571 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09855 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09842 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09694 |
| published_at |
2026-04-18T12:55:00Z |
|
| 3 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09724 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09841 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09857 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09893 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09887 |
| published_at |
2026-04-24T12:55:00Z |
|
| 8 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09834 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09762 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09862 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09812 |
| published_at |
2026-04-02T12:55:00Z |
|
| 12 |
| value |
0.00034 |
| scoring_system |
epss |
| scoring_elements |
0.09741 |
| published_at |
2026-04-01T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-33571 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-33571, CVE-2021-33571, GHSA-p99v-5w3c-jqq9, PYSEC-2021-99
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-c8s7-3g9m-d3cw |
|
| 10 |
| url |
VCID-e2jd-yd4j-kqgt |
| vulnerability_id |
VCID-e2jd-yd4j-kqgt |
| summary |
Django allows enumeration of user e-mail addresses
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45231 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46354 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46342 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.4636 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46415 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46418 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46361 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.4635 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46379 |
| published_at |
2026-04-11T12:55:00Z |
|
| 8 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46355 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46299 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46351 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.00235 |
| scoring_system |
epss |
| scoring_elements |
0.46331 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45231 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
3.7 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
3.7 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 2 |
| value |
6.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-30T16:35:34Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-45231, GHSA-rrqc-c2jx-6jgv
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-e2jd-yd4j-kqgt |
|
| 11 |
| url |
VCID-e87q-1j8h-93hh |
| vulnerability_id |
VCID-e87q-1j8h-93hh |
| summary |
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the django.forms.GenericIPAddressField form field. (The django.db.models.GenericIPAddressField model field is not affected.) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-56374 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24443 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24532 |
| published_at |
2026-04-13T12:55:00Z |
|
| 2 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24512 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24537 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24545 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24586 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24629 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24612 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24567 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24496 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24724 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24686 |
| published_at |
2026-04-02T12:55:00Z |
|
| 12 |
| value |
0.00084 |
| scoring_system |
epss |
| scoring_elements |
0.24457 |
| published_at |
2026-04-24T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-56374 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-56374, CVE-2024-56374, GHSA-qcgg-j2x8-h9g8, PYSEC-2025-1
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-e87q-1j8h-93hh |
|
| 12 |
| url |
VCID-gan1-9gwu-63d2 |
| vulnerability_id |
VCID-gan1-9gwu-63d2 |
| summary |
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-35042 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.9958 |
| published_at |
2026-04-18T12:55:00Z |
|
| 1 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.99579 |
| published_at |
2026-04-13T12:55:00Z |
|
| 2 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.99578 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.99577 |
| published_at |
2026-04-04T12:55:00Z |
|
| 4 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.99583 |
| published_at |
2026-04-26T12:55:00Z |
|
| 5 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.99582 |
| published_at |
2026-04-24T12:55:00Z |
|
| 6 |
| value |
0.89973 |
| scoring_system |
epss |
| scoring_elements |
0.99576 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-35042 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://github.com/advisories/GHSA-xpfp-f569-q3p2 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
CRITICAL |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 3 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-xpfp-f569-q3p2 |
|
| 5 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-35042, CVE-2021-35042, GHSA-xpfp-f569-q3p2, PYSEC-2021-109
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gan1-9gwu-63d2 |
|
| 13 |
| url |
VCID-gp5e-nguh-5fdk |
| vulnerability_id |
VCID-gp5e-nguh-5fdk |
| summary |
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-23833 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87718 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.8776 |
| published_at |
2026-04-09T12:55:00Z |
|
| 2 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87754 |
| published_at |
2026-04-08T12:55:00Z |
|
| 3 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87733 |
| published_at |
2026-04-07T12:55:00Z |
|
| 4 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87731 |
| published_at |
2026-04-04T12:55:00Z |
|
| 5 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.878 |
| published_at |
2026-04-26T12:55:00Z |
|
| 6 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87793 |
| published_at |
2026-04-24T12:55:00Z |
|
| 7 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87776 |
| published_at |
2026-04-21T12:55:00Z |
|
| 8 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87777 |
| published_at |
2026-04-18T12:55:00Z |
|
| 9 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87778 |
| published_at |
2026-04-16T12:55:00Z |
|
| 10 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87764 |
| published_at |
2026-04-13T12:55:00Z |
|
| 11 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87766 |
| published_at |
2026-04-12T12:55:00Z |
|
| 12 |
| value |
0.03594 |
| scoring_system |
epss |
| scoring_elements |
0.87771 |
| published_at |
2026-04-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-23833 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-23833, CVE-2022-23833, GHSA-6cw3-g6wv-c2xv, PYSEC-2022-20
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gp5e-nguh-5fdk |
|
| 14 |
| url |
VCID-hwa2-n7a2-pyg1 |
| vulnerability_id |
VCID-hwa2-n7a2-pyg1 |
| summary |
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45116 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.5704 |
| published_at |
2026-04-01T12:55:00Z |
|
| 1 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57112 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57092 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57161 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57182 |
| published_at |
2026-04-18T12:55:00Z |
|
| 5 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57186 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57158 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57178 |
| published_at |
2026-04-12T12:55:00Z |
|
| 8 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57135 |
| published_at |
2026-04-02T12:55:00Z |
|
| 9 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57199 |
| published_at |
2026-04-11T12:55:00Z |
|
| 10 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57187 |
| published_at |
2026-04-09T12:55:00Z |
|
| 11 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57185 |
| published_at |
2026-04-08T12:55:00Z |
|
| 12 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57157 |
| published_at |
2026-04-04T12:55:00Z |
|
| 13 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57133 |
| published_at |
2026-04-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45116 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-45116, CVE-2021-45116, GHSA-8c5j-9r9f-c6w8, PYSEC-2022-2
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hwa2-n7a2-pyg1 |
|
| 15 |
| url |
VCID-jh1e-72hp-fuf4 |
| vulnerability_id |
VCID-jh1e-72hp-fuf4 |
| summary |
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-27351 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01855 |
| scoring_system |
epss |
| scoring_elements |
0.82977 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85687 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.8567 |
| published_at |
2026-04-18T12:55:00Z |
|
| 3 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85604 |
| published_at |
2026-04-07T12:55:00Z |
|
| 4 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85698 |
| published_at |
2026-04-26T12:55:00Z |
|
| 5 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85646 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.8565 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85635 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85624 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85599 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85665 |
| published_at |
2026-04-21T12:55:00Z |
|
| 11 |
| value |
0.02611 |
| scoring_system |
epss |
| scoring_elements |
0.85642 |
| published_at |
2026-04-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-27351 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
| 55 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-27351, CVE-2024-27351, GHSA-vm8q-m57g-pff3, PYSEC-2024-47
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jh1e-72hp-fuf4 |
|
| 16 |
| url |
VCID-jzae-1awh-k7cm |
| vulnerability_id |
VCID-jzae-1awh-k7cm |
| summary |
An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-38875 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55967 |
| published_at |
2026-04-13T12:55:00Z |
|
| 1 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55907 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55981 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.56006 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.56003 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55985 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.56005 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55994 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55992 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55962 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55941 |
| published_at |
2026-04-07T12:55:00Z |
|
| 11 |
| value |
0.0033 |
| scoring_system |
epss |
| scoring_elements |
0.55928 |
| published_at |
2026-04-26T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-38875 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-38875, CVE-2024-38875, GHSA-qg2p-9jwr-mmqf, PYSEC-2024-56
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jzae-1awh-k7cm |
|
| 17 |
| url |
VCID-kypj-ptb9-8qhz |
| vulnerability_id |
VCID-kypj-ptb9-8qhz |
| summary |
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-31542 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91413 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91334 |
| published_at |
2026-04-02T12:55:00Z |
|
| 2 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91378 |
| published_at |
2026-04-11T12:55:00Z |
|
| 3 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91371 |
| published_at |
2026-04-09T12:55:00Z |
|
| 4 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91364 |
| published_at |
2026-04-08T12:55:00Z |
|
| 5 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.9133 |
| published_at |
2026-04-01T12:55:00Z |
|
| 6 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91352 |
| published_at |
2026-04-07T12:55:00Z |
|
| 7 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91344 |
| published_at |
2026-04-04T12:55:00Z |
|
| 8 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91415 |
| published_at |
2026-04-24T12:55:00Z |
|
| 9 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91403 |
| published_at |
2026-04-18T12:55:00Z |
|
| 10 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91405 |
| published_at |
2026-04-21T12:55:00Z |
|
| 11 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.9138 |
| published_at |
2026-04-13T12:55:00Z |
|
| 12 |
| value |
0.06886 |
| scoring_system |
epss |
| scoring_elements |
0.91381 |
| published_at |
2026-04-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-31542 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-31542, CVE-2021-31542, GHSA-rxjp-mfm9-w4wr, PYSEC-2021-7
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kypj-ptb9-8qhz |
|
| 18 |
| url |
VCID-m91a-6235-nye9 |
| vulnerability_id |
VCID-m91a-6235-nye9 |
| summary |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-42005 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55793 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55775 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55809 |
| published_at |
2026-04-07T12:55:00Z |
|
| 3 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55829 |
| published_at |
2026-04-04T12:55:00Z |
|
| 4 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55834 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55852 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55873 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55863 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.5586 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55848 |
| published_at |
2026-04-21T12:55:00Z |
|
| 10 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55874 |
| published_at |
2026-04-18T12:55:00Z |
|
| 11 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.5587 |
| published_at |
2026-04-16T12:55:00Z |
|
| 12 |
| value |
0.00328 |
| scoring_system |
epss |
| scoring_elements |
0.55807 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-42005 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
|
| 1 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
|
| 1 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 2 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-08-16T20:19:17Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-42005, CVE-2024-42005, GHSA-pv4p-cwwg-4rph, PYSEC-2024-70
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m91a-6235-nye9 |
|
| 19 |
| url |
VCID-mga4-an1w-qqf9 |
| vulnerability_id |
VCID-mga4-an1w-qqf9 |
| summary |
Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45230 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85977 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85968 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85948 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85957 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85953 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85935 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.8594 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85942 |
| published_at |
2026-04-11T12:55:00Z |
|
| 8 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85928 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85899 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85896 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.8588 |
| published_at |
2026-04-02T12:55:00Z |
|
| 12 |
| value |
0.02721 |
| scoring_system |
epss |
| scoring_elements |
0.85918 |
| published_at |
2026-04-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-45230 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-10-30T16:30:05Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-45230, CVE-2024-45230, GHSA-5hgc-2vfp-mqvc, PYSEC-2024-102
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mga4-an1w-qqf9 |
|
| 20 |
| url |
VCID-mzdk-m12w-q3fc |
| vulnerability_id |
VCID-mzdk-m12w-q3fc |
| summary |
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-44420 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30618 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30735 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30895 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30929 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.3095 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30919 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30964 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.31097 |
| published_at |
2026-04-04T12:55:00Z |
|
| 8 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.3105 |
| published_at |
2026-04-02T12:55:00Z |
|
| 9 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.31007 |
| published_at |
2026-04-11T12:55:00Z |
|
| 10 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.31002 |
| published_at |
2026-04-09T12:55:00Z |
|
| 11 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30973 |
| published_at |
2026-04-08T12:55:00Z |
|
| 12 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30915 |
| published_at |
2026-04-07T12:55:00Z |
|
| 13 |
| value |
0.0012 |
| scoring_system |
epss |
| scoring_elements |
0.30921 |
| published_at |
2026-04-01T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-44420 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/advisories/GHSA-v6rh-hp5x-86rv |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-v6rh-hp5x-86rv |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-44420, CVE-2021-44420, GHSA-v6rh-hp5x-86rv, PYSEC-2021-439
|
| risk_score |
3.3 |
| exploitability |
0.5 |
| weighted_severity |
6.6 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mzdk-m12w-q3fc |
|
| 21 |
| url |
VCID-nese-5485-hkbs |
| vulnerability_id |
VCID-nese-5485-hkbs |
| summary |
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-23969 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90732 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90805 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90804 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90793 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90796 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90777 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.9078 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90771 |
| published_at |
2026-04-09T12:55:00Z |
|
| 8 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90765 |
| published_at |
2026-04-08T12:55:00Z |
|
| 9 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90754 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.06091 |
| scoring_system |
epss |
| scoring_elements |
0.90743 |
| published_at |
2026-04-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-23969 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2023-23969, CVE-2023-23969, GHSA-q2jf-h9jm-m7p4, PYSEC-2023-12
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nese-5485-hkbs |
|
| 22 |
| url |
VCID-pa75-6avj-duf7 |
| vulnerability_id |
VCID-pa75-6avj-duf7 |
| summary |
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-28346 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83532 |
| published_at |
2026-04-09T12:55:00Z |
|
| 1 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83541 |
| published_at |
2026-04-12T12:55:00Z |
|
| 2 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83484 |
| published_at |
2026-04-02T12:55:00Z |
|
| 3 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83498 |
| published_at |
2026-04-07T12:55:00Z |
|
| 4 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83522 |
| published_at |
2026-04-08T12:55:00Z |
|
| 5 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83547 |
| published_at |
2026-04-11T12:55:00Z |
|
| 6 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83604 |
| published_at |
2026-04-26T12:55:00Z |
|
| 7 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83597 |
| published_at |
2026-04-24T12:55:00Z |
|
| 8 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83572 |
| published_at |
2026-04-21T12:55:00Z |
|
| 9 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83571 |
| published_at |
2026-04-16T12:55:00Z |
|
| 10 |
| value |
0.01971 |
| scoring_system |
epss |
| scoring_elements |
0.83536 |
| published_at |
2026-04-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-28346 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
| reference_url |
https://github.com/advisories/GHSA-2gwj-7jmv-h26r |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
CRITICAL |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 3 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-2gwj-7jmv-h26r |
|
| 13 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-28346, CVE-2022-28346, GHSA-2gwj-7jmv-h26r, PYSEC-2022-190
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pa75-6avj-duf7 |
|
| 23 |
| url |
VCID-q12d-kv8p-8ff7 |
| vulnerability_id |
VCID-q12d-kv8p-8ff7 |
| summary |
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-39329 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37652 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37619 |
| published_at |
2026-04-09T12:55:00Z |
|
| 2 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37607 |
| published_at |
2026-04-08T12:55:00Z |
|
| 3 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37555 |
| published_at |
2026-04-07T12:55:00Z |
|
| 4 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37676 |
| published_at |
2026-04-04T12:55:00Z |
|
| 5 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37533 |
| published_at |
2026-04-21T12:55:00Z |
|
| 6 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37596 |
| published_at |
2026-04-18T12:55:00Z |
|
| 7 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37615 |
| published_at |
2026-04-16T12:55:00Z |
|
| 8 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37571 |
| published_at |
2026-04-13T12:55:00Z |
|
| 9 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37599 |
| published_at |
2026-04-12T12:55:00Z |
|
| 10 |
| value |
0.00165 |
| scoring_system |
epss |
| scoring_elements |
0.37632 |
| published_at |
2026-04-11T12:55:00Z |
|
| 11 |
| value |
0.00166 |
| scoring_system |
epss |
| scoring_elements |
0.37386 |
| published_at |
2026-04-24T12:55:00Z |
|
| 12 |
| value |
0.00166 |
| scoring_system |
epss |
| scoring_elements |
0.37365 |
| published_at |
2026-04-26T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-39329 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-39329, CVE-2024-39329, GHSA-x7q2-wr7g-xqmf, PYSEC-2024-57
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q12d-kv8p-8ff7 |
|
| 24 |
| url |
VCID-qm34-ec8s-tfd7 |
| vulnerability_id |
VCID-qm34-ec8s-tfd7 |
| summary |
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-33203 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55594 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55577 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.5565 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55671 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55667 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55489 |
| published_at |
2026-04-01T12:55:00Z |
|
| 6 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55629 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55646 |
| published_at |
2026-04-12T12:55:00Z |
|
| 8 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55666 |
| published_at |
2026-04-11T12:55:00Z |
|
| 9 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55657 |
| published_at |
2026-04-09T12:55:00Z |
|
| 10 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55654 |
| published_at |
2026-04-08T12:55:00Z |
|
| 11 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55603 |
| published_at |
2026-04-07T12:55:00Z |
|
| 12 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.55625 |
| published_at |
2026-04-04T12:55:00Z |
|
| 13 |
| value |
0.00327 |
| scoring_system |
epss |
| scoring_elements |
0.556 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-33203 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/advisories/GHSA-68w8-qjq3-2gfm |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-68w8-qjq3-2gfm |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-33203, CVE-2021-33203, GHSA-68w8-qjq3-2gfm, PYSEC-2021-98
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qm34-ec8s-tfd7 |
|
| 25 |
| url |
VCID-t6uc-dfrd-jyfg |
| vulnerability_id |
VCID-t6uc-dfrd-jyfg |
| summary |
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-34265 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.92834 |
| scoring_system |
epss |
| scoring_elements |
0.99767 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.92834 |
| scoring_system |
epss |
| scoring_elements |
0.99766 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.92834 |
| scoring_system |
epss |
| scoring_elements |
0.99765 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.92834 |
| scoring_system |
epss |
| scoring_elements |
0.99764 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.92834 |
| scoring_system |
epss |
| scoring_elements |
0.99763 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.92834 |
| scoring_system |
epss |
| scoring_elements |
0.99762 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-34265 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
| reference_url |
https://github.com/advisories/GHSA-p64x-8rxx-wf6q |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
CRITICAL |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 3 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-p64x-8rxx-wf6q |
|
| 13 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-34265, CVE-2022-34265, GHSA-p64x-8rxx-wf6q, PYSEC-2022-213
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t6uc-dfrd-jyfg |
|
| 26 |
| url |
VCID-th9v-dk98-3kea |
| vulnerability_id |
VCID-th9v-dk98-3kea |
| summary |
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-28347 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00668 |
| scoring_system |
epss |
| scoring_elements |
0.71356 |
| published_at |
2026-04-24T12:55:00Z |
|
| 1 |
| value |
0.00668 |
| scoring_system |
epss |
| scoring_elements |
0.71363 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78089 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78054 |
| published_at |
2026-04-13T12:55:00Z |
|
| 4 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78081 |
| published_at |
2026-04-21T12:55:00Z |
|
| 5 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78088 |
| published_at |
2026-04-18T12:55:00Z |
|
| 6 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78043 |
| published_at |
2026-04-08T12:55:00Z |
|
| 7 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78017 |
| published_at |
2026-04-07T12:55:00Z |
|
| 8 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78034 |
| published_at |
2026-04-04T12:55:00Z |
|
| 9 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78005 |
| published_at |
2026-04-02T12:55:00Z |
|
| 10 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78057 |
| published_at |
2026-04-12T12:55:00Z |
|
| 11 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78075 |
| published_at |
2026-04-11T12:55:00Z |
|
| 12 |
| value |
0.01101 |
| scoring_system |
epss |
| scoring_elements |
0.78048 |
| published_at |
2026-04-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-28347 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
| reference_url |
https://github.com/advisories/GHSA-w24h-v9qh-8gxj |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
CRITICAL |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 3 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-w24h-v9qh-8gxj |
|
| 13 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
9.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-28347, CVE-2022-28347, GHSA-w24h-v9qh-8gxj, PYSEC-2022-191
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-th9v-dk98-3kea |
|
| 27 |
| url |
VCID-u3zk-tff2-aua9 |
| vulnerability_id |
VCID-u3zk-tff2-aua9 |
| summary |
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-39614 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91346 |
| published_at |
2026-04-11T12:55:00Z |
|
| 1 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91382 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91371 |
| published_at |
2026-04-18T12:55:00Z |
|
| 3 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91373 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91348 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91349 |
| published_at |
2026-04-12T12:55:00Z |
|
| 6 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91339 |
| published_at |
2026-04-09T12:55:00Z |
|
| 7 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91334 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91321 |
| published_at |
2026-04-07T12:55:00Z |
|
| 9 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91314 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91304 |
| published_at |
2026-04-02T12:55:00Z |
|
| 11 |
| value |
0.06838 |
| scoring_system |
epss |
| scoring_elements |
0.91381 |
| published_at |
2026-04-26T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-39614 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-39614, CVE-2024-39614, GHSA-f6f8-9mx6-9mx2, PYSEC-2024-59
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u3zk-tff2-aua9 |
|
| 28 |
| url |
VCID-u7m5-tzv2-c7hn |
| vulnerability_id |
VCID-u7m5-tzv2-c7hn |
| summary |
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-28658 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81101 |
| published_at |
2026-04-01T12:55:00Z |
|
| 1 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81203 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81202 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81165 |
| published_at |
2026-04-13T12:55:00Z |
|
| 4 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81172 |
| published_at |
2026-04-12T12:55:00Z |
|
| 5 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81185 |
| published_at |
2026-04-11T12:55:00Z |
|
| 6 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81166 |
| published_at |
2026-04-09T12:55:00Z |
|
| 7 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.8116 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81133 |
| published_at |
2026-04-07T12:55:00Z |
|
| 9 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81134 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81109 |
| published_at |
2026-04-02T12:55:00Z |
|
| 11 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81231 |
| published_at |
2026-04-26T12:55:00Z |
|
| 12 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81224 |
| published_at |
2026-04-24T12:55:00Z |
|
| 13 |
| value |
0.01505 |
| scoring_system |
epss |
| scoring_elements |
0.81201 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-28658 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/advisories/GHSA-xgxc-v2qg-chmh |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-xgxc-v2qg-chmh |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
| reference_url |
https://pypi.org/project/Django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://pypi.org/project/Django |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-28658, CVE-2021-28658, GHSA-xgxc-v2qg-chmh, PYSEC-2021-6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u7m5-tzv2-c7hn |
|
| 29 |
| url |
VCID-ume2-wt6y-jye7 |
| vulnerability_id |
VCID-ume2-wt6y-jye7 |
| summary |
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-22818 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.69492 |
| published_at |
2026-04-12T12:55:00Z |
|
| 1 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.69478 |
| published_at |
2026-04-13T12:55:00Z |
|
| 2 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.69507 |
| published_at |
2026-04-11T12:55:00Z |
|
| 3 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.69486 |
| published_at |
2026-04-09T12:55:00Z |
|
| 4 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.6947 |
| published_at |
2026-04-08T12:55:00Z |
|
| 5 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.6942 |
| published_at |
2026-04-07T12:55:00Z |
|
| 6 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.6944 |
| published_at |
2026-04-04T12:55:00Z |
|
| 7 |
| value |
0.00601 |
| scoring_system |
epss |
| scoring_elements |
0.69424 |
| published_at |
2026-04-02T12:55:00Z |
|
| 8 |
| value |
0.01009 |
| scoring_system |
epss |
| scoring_elements |
0.77158 |
| published_at |
2026-04-26T12:55:00Z |
|
| 9 |
| value |
0.01009 |
| scoring_system |
epss |
| scoring_elements |
0.77151 |
| published_at |
2026-04-24T12:55:00Z |
|
| 10 |
| value |
0.01009 |
| scoring_system |
epss |
| scoring_elements |
0.77117 |
| published_at |
2026-04-21T12:55:00Z |
|
| 11 |
| value |
0.01009 |
| scoring_system |
epss |
| scoring_elements |
0.77126 |
| published_at |
2026-04-18T12:55:00Z |
|
| 12 |
| value |
0.01009 |
| scoring_system |
epss |
| scoring_elements |
0.77125 |
| published_at |
2026-04-16T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-22818 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
| reference_url |
https://github.com/advisories/GHSA-95rw-fx8r-36v6 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-95rw-fx8r-36v6 |
|
| 13 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2022-22818, CVE-2022-22818, GHSA-95rw-fx8r-36v6, PYSEC-2022-19
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ume2-wt6y-jye7 |
|
| 30 |
| url |
VCID-v1xr-z4zu-yfb4 |
| vulnerability_id |
VCID-v1xr-z4zu-yfb4 |
| summary |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-41989 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80394 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80387 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80331 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80354 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80324 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80346 |
| published_at |
2026-04-11T12:55:00Z |
|
| 6 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80327 |
| published_at |
2026-04-09T12:55:00Z |
|
| 7 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80316 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80288 |
| published_at |
2026-04-07T12:55:00Z |
|
| 9 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.803 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80279 |
| published_at |
2026-04-02T12:55:00Z |
|
| 11 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80361 |
| published_at |
2026-04-21T12:55:00Z |
|
| 12 |
| value |
0.01386 |
| scoring_system |
epss |
| scoring_elements |
0.80356 |
| published_at |
2026-04-18T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-41989 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-08T19:34:43Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-41989, CVE-2024-41989, GHSA-jh75-99hh-qvx9, PYSEC-2024-67
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-v1xr-z4zu-yfb4 |
|
| 31 |
| url |
VCID-v4ad-xxy8-wfc9 |
| vulnerability_id |
VCID-v4ad-xxy8-wfc9 |
| summary |
In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-32052 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85601 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85473 |
| published_at |
2026-04-01T12:55:00Z |
|
| 2 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.8559 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85569 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85573 |
| published_at |
2026-04-18T12:55:00Z |
|
| 5 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85568 |
| published_at |
2026-04-16T12:55:00Z |
|
| 6 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85544 |
| published_at |
2026-04-13T12:55:00Z |
|
| 7 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85548 |
| published_at |
2026-04-12T12:55:00Z |
|
| 8 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.8555 |
| published_at |
2026-04-11T12:55:00Z |
|
| 9 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85535 |
| published_at |
2026-04-09T12:55:00Z |
|
| 10 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85526 |
| published_at |
2026-04-08T12:55:00Z |
|
| 11 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85506 |
| published_at |
2026-04-07T12:55:00Z |
|
| 12 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85502 |
| published_at |
2026-04-04T12:55:00Z |
|
| 13 |
| value |
0.02571 |
| scoring_system |
epss |
| scoring_elements |
0.85486 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-32052 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
https://github.com/advisories/GHSA-qm57-vhq3-3fwf |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-qm57-vhq3-3fwf |
|
| 8 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-32052, CVE-2021-32052, GHSA-qm57-vhq3-3fwf, PYSEC-2021-8
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-v4ad-xxy8-wfc9 |
|
| 32 |
| url |
VCID-wwa5-mhgu-9khz |
| vulnerability_id |
VCID-wwa5-mhgu-9khz |
| summary |
Django denial-of-service in django.utils.html.strip_tags()
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-53907 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77483 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77477 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77442 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.7745 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77364 |
| published_at |
2026-04-02T12:55:00Z |
|
| 5 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77371 |
| published_at |
2026-04-07T12:55:00Z |
|
| 6 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.7739 |
| published_at |
2026-04-04T12:55:00Z |
|
| 7 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77452 |
| published_at |
2026-04-16T12:55:00Z |
|
| 8 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77412 |
| published_at |
2026-04-13T12:55:00Z |
|
| 9 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77416 |
| published_at |
2026-04-12T12:55:00Z |
|
| 10 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.77436 |
| published_at |
2026-04-11T12:55:00Z |
|
| 11 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.7741 |
| published_at |
2026-04-09T12:55:00Z |
|
| 12 |
| value |
0.01038 |
| scoring_system |
epss |
| scoring_elements |
0.774 |
| published_at |
2026-04-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-53907 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
6.6 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 28 |
|
| 29 |
| reference_url |
https://groups.google.com/g/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
6.6 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-12-06T16:22:53Z/ |
|
|
| url |
https://groups.google.com/g/django-announce |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-53907, GHSA-8498-2h75-472j
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wwa5-mhgu-9khz |
|
| 33 |
| url |
VCID-xgv1-s2ek-q3dp |
| vulnerability_id |
VCID-xgv1-s2ek-q3dp |
| summary |
An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-26699 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00287 |
| scoring_system |
epss |
| scoring_elements |
0.52132 |
| published_at |
2026-04-24T12:55:00Z |
|
| 1 |
| value |
0.00287 |
| scoring_system |
epss |
| scoring_elements |
0.52185 |
| published_at |
2026-04-21T12:55:00Z |
|
| 2 |
| value |
0.00287 |
| scoring_system |
epss |
| scoring_elements |
0.52203 |
| published_at |
2026-04-18T12:55:00Z |
|
| 3 |
| value |
0.00287 |
| scoring_system |
epss |
| scoring_elements |
0.52199 |
| published_at |
2026-04-16T12:55:00Z |
|
| 4 |
| value |
0.00287 |
| scoring_system |
epss |
| scoring_elements |
0.52138 |
| published_at |
2026-04-26T12:55:00Z |
|
| 5 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81643 |
| published_at |
2026-04-07T12:55:00Z |
|
| 6 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81646 |
| published_at |
2026-04-04T12:55:00Z |
|
| 7 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81624 |
| published_at |
2026-04-02T12:55:00Z |
|
| 8 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81676 |
| published_at |
2026-04-13T12:55:00Z |
|
| 9 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81682 |
| published_at |
2026-04-12T12:55:00Z |
|
| 10 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81695 |
| published_at |
2026-04-11T12:55:00Z |
|
| 11 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.81675 |
| published_at |
2026-04-09T12:55:00Z |
|
| 12 |
| value |
0.01596 |
| scoring_system |
epss |
| scoring_elements |
0.8167 |
| published_at |
2026-04-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-26699 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
| reference_url |
https://groups.google.com/g/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L |
|
| 1 |
| value |
5.0 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-06T20:30:28Z/ |
|
|
| url |
https://groups.google.com/g/django-announce |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2025-26699, CVE-2025-26699, GHSA-p3fp-8748-vqfq, PYSEC-2025-13
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xgv1-s2ek-q3dp |
|
| 34 |
| url |
VCID-xhpa-mffz-syfy |
| vulnerability_id |
VCID-xhpa-mffz-syfy |
| summary |
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-41990 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79983 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79978 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79925 |
| published_at |
2026-04-12T12:55:00Z |
|
| 3 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79946 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79917 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79941 |
| published_at |
2026-04-11T12:55:00Z |
|
| 6 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79921 |
| published_at |
2026-04-09T12:55:00Z |
|
| 7 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79912 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79884 |
| published_at |
2026-04-07T12:55:00Z |
|
| 9 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79896 |
| published_at |
2026-04-04T12:55:00Z |
|
| 10 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79875 |
| published_at |
2026-04-02T12:55:00Z |
|
| 11 |
| value |
0.01326 |
| scoring_system |
epss |
| scoring_elements |
0.79949 |
| published_at |
2026-04-21T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-41990 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-08-07T15:20:51Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-41990, CVE-2024-41990, GHSA-795c-9xpc-xw6g, PYSEC-2024-68
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-xhpa-mffz-syfy |
|
| 35 |
| url |
VCID-ypub-ukuh-p3aw |
| vulnerability_id |
VCID-ypub-ukuh-p3aw |
| summary |
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-24580 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96195 |
| published_at |
2026-04-07T12:55:00Z |
|
| 1 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96228 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96227 |
| published_at |
2026-04-24T12:55:00Z |
|
| 3 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96226 |
| published_at |
2026-04-21T12:55:00Z |
|
| 4 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96184 |
| published_at |
2026-04-02T12:55:00Z |
|
| 5 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96191 |
| published_at |
2026-04-04T12:55:00Z |
|
| 6 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96222 |
| published_at |
2026-04-16T12:55:00Z |
|
| 7 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96213 |
| published_at |
2026-04-13T12:55:00Z |
|
| 8 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96211 |
| published_at |
2026-04-12T12:55:00Z |
|
| 9 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96212 |
| published_at |
2026-04-11T12:55:00Z |
|
| 10 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96208 |
| published_at |
2026-04-09T12:55:00Z |
|
| 11 |
| value |
0.25408 |
| scoring_system |
epss |
| scoring_elements |
0.96205 |
| published_at |
2026-04-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-24580 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2023-24580, CVE-2023-24580, GHSA-2hrw-hx67-34x6, PYSEC-2023-13
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ypub-ukuh-p3aw |
|
| 36 |
| url |
VCID-z27q-zfpz-ckby |
| vulnerability_id |
VCID-z27q-zfpz-ckby |
| summary |
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-39330 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40248 |
| published_at |
2026-04-26T12:55:00Z |
|
| 1 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40261 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.4037 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40445 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40476 |
| published_at |
2026-04-16T12:55:00Z |
|
| 5 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40429 |
| published_at |
2026-04-13T12:55:00Z |
|
| 6 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40448 |
| published_at |
2026-04-12T12:55:00Z |
|
| 7 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40486 |
| published_at |
2026-04-11T12:55:00Z |
|
| 8 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40465 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40402 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.4048 |
| published_at |
2026-04-04T12:55:00Z |
|
| 11 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40454 |
| published_at |
2026-04-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-39330 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
| reference_url |
https://groups.google.com/forum/#%21forum/django-announce |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 2 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 4 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-10T13:59:56Z/ |
|
|
| url |
https://groups.google.com/forum/#%21forum/django-announce |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2024-39330, CVE-2024-39330, GHSA-9jmf-237g-qf46, PYSEC-2024-58
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z27q-zfpz-ckby |
|
| 37 |
| url |
VCID-z8z1-cjee-kfeg |
| vulnerability_id |
VCID-z8z1-cjee-kfeg |
| summary |
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45115 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62355 |
| published_at |
2026-04-01T12:55:00Z |
|
| 1 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62522 |
| published_at |
2026-04-26T12:55:00Z |
|
| 2 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62495 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62512 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62506 |
| published_at |
2026-04-24T12:55:00Z |
|
| 5 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62411 |
| published_at |
2026-04-07T12:55:00Z |
|
| 6 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62413 |
| published_at |
2026-04-02T12:55:00Z |
|
| 7 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62444 |
| published_at |
2026-04-04T12:55:00Z |
|
| 8 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62475 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62461 |
| published_at |
2026-04-13T12:55:00Z |
|
| 10 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62483 |
| published_at |
2026-04-12T12:55:00Z |
|
| 11 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62494 |
| published_at |
2026-04-11T12:55:00Z |
|
| 12 |
| value |
0.00428 |
| scoring_system |
epss |
| scoring_elements |
0.62459 |
| published_at |
2026-04-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45115 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
|
| fixed_packages |
|
| aliases |
BIT-django-2021-45115, CVE-2021-45115, GHSA-53qw-q765-4fww, PYSEC-2022-1
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z8z1-cjee-kfeg |
|
|
|---|