{"url":"http://public2.vulnerablecode.io/api/packages/46603?format=json","purl":"pkg:pypi/django@5.2.9","type":"pypi","namespace":"","name":"django","version":"5.2.9","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"5.2.14","latest_non_vulnerable_version":"6.0.5","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37199?format=json","vulnerability_id":"VCID-4kcg-gx5y-cuaw","summary":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nRaster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1207","reference_id":"CVE-2026-1207","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1207"},{"reference_url":"https://github.com/advisories/GHSA-mwm9-4648-f68q","reference_id":"GHSA-mwm9-4648-f68q","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-mwm9-4648-f68q"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47228?format=json","purl":"pkg:pypi/django@5.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/47229?format=json","purl":"pkg:pypi/django@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2"}],"aliases":["CVE-2026-1207","GHSA-mwm9-4648-f68q","PYSEC-2026-44"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4kcg-gx5y-cuaw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37310?format=json","vulnerability_id":"VCID-abpe-htm1-9ubp","summary":"An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50019?format=json","purl":"pkg:pypi/django@5.2.14","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.14"},{"url":"http://public2.vulnerablecode.io/api/packages/50020?format=json","purl":"pkg:pypi/django@6.0.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.5"}],"aliases":["CVE-2026-35192","PYSEC-2026-50"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-abpe-htm1-9ubp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37312?format=json","vulnerability_id":"VCID-eqsc-axng-ckca","summary":"An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\n`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmad Sadeddin for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50019?format=json","purl":"pkg:pypi/django@5.2.14","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.14"},{"url":"http://public2.vulnerablecode.io/api/packages/50020?format=json","purl":"pkg:pypi/django@6.0.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.5"}],"aliases":["CVE-2026-6907","PYSEC-2026-55"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-eqsc-axng-ckca"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37269?format=json","vulnerability_id":"VCID-ga7z-wj4j-63h1","summary":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nASGI requests with a missing or understated `Content-Length` header could\nbypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading\n`HttpRequest.body`, allowing remote attackers to load an unbounded request body into\nmemory.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Superior for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/49222?format=json","purl":"pkg:pypi/django@5.2.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13"},{"url":"http://public2.vulnerablecode.io/api/packages/49223?format=json","purl":"pkg:pypi/django@6.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4"}],"aliases":["CVE-2026-33034","PYSEC-2026-49"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ga7z-wj4j-63h1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37197?format=json","vulnerability_id":"VCID-jybd-p65h-xffy","summary":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13473","reference_id":"CVE-2025-13473","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13473"},{"reference_url":"https://github.com/advisories/GHSA-2mcm-79hx-8fxw","reference_id":"GHSA-2mcm-79hx-8fxw","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-2mcm-79hx-8fxw"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47228?format=json","purl":"pkg:pypi/django@5.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/47229?format=json","purl":"pkg:pypi/django@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2"}],"aliases":["CVE-2025-13473","GHSA-2mcm-79hx-8fxw","PYSEC-2026-42"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jybd-p65h-xffy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37271?format=json","vulnerability_id":"VCID-kxdd-yzp3-r7cb","summary":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdd permissions on inline model instances were not validated on submission of\nforged `POST` data in `GenericInlineModelAdmin`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank N05ec@LZU-DSLab for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/49222?format=json","purl":"pkg:pypi/django@5.2.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13"},{"url":"http://public2.vulnerablecode.io/api/packages/49223?format=json","purl":"pkg:pypi/django@6.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4"}],"aliases":["CVE-2026-4277","PYSEC-2026-52"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kxdd-yzp3-r7cb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37311?format=json","vulnerability_id":"VCID-m4am-h2ea-3ffr","summary":"An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.\n \nAs a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kyle Agronick for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"url":"https://www.djangoproject.com/weblog/2026/may/05/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/50019?format=json","purl":"pkg:pypi/django@5.2.14","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.14"},{"url":"http://public2.vulnerablecode.io/api/packages/50020?format=json","purl":"pkg:pypi/django@6.0.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.5"}],"aliases":["CVE-2026-5766","PYSEC-2026-54"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m4am-h2ea-3ffr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37270?format=json","vulnerability_id":"VCID-phkp-9abp-f3dq","summary":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/49222?format=json","purl":"pkg:pypi/django@5.2.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13"},{"url":"http://public2.vulnerablecode.io/api/packages/49223?format=json","purl":"pkg:pypi/django@6.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4"}],"aliases":["CVE-2026-3902","PYSEC-2026-51"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-phkp-9abp-f3dq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37198?format=json","vulnerability_id":"VCID-r1vx-vv7d-gqaj","summary":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Jiyong Yang for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/eb22e1d6d643360e952609ef562c139a100ea4eb"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14550","reference_id":"CVE-2025-14550","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14550"},{"reference_url":"https://github.com/advisories/GHSA-33mw-q7rj-mjwj","reference_id":"GHSA-33mw-q7rj-mjwj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-33mw-q7rj-mjwj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47228?format=json","purl":"pkg:pypi/django@5.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/47229?format=json","purl":"pkg:pypi/django@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2"}],"aliases":["CVE-2025-14550","GHSA-33mw-q7rj-mjwj","PYSEC-2026-43"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r1vx-vv7d-gqaj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37200?format=json","vulnerability_id":"VCID-shch-yusm-1uck","summary":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/a33540b3e20b5d759aa8b2e4b9ca0e8edd285344"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1285","reference_id":"CVE-2026-1285","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1285"},{"reference_url":"https://github.com/advisories/GHSA-4rrr-2h4v-f3j9","reference_id":"GHSA-4rrr-2h4v-f3j9","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-4rrr-2h4v-f3j9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47228?format=json","purl":"pkg:pypi/django@5.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/47229?format=json","purl":"pkg:pypi/django@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2"}],"aliases":["CVE-2026-1285","GHSA-4rrr-2h4v-f3j9","PYSEC-2026-45"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-shch-yusm-1uck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37202?format=json","vulnerability_id":"VCID-shjc-2j68-2yfy","summary":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84"},{"reference_url":"https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1312","reference_id":"CVE-2026-1312","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1312"},{"reference_url":"https://github.com/advisories/GHSA-6426-9fv3-65x8","reference_id":"GHSA-6426-9fv3-65x8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-6426-9fv3-65x8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47228?format=json","purl":"pkg:pypi/django@5.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/47229?format=json","purl":"pkg:pypi/django@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2"}],"aliases":["CVE-2026-1312","GHSA-6426-9fv3-65x8","PYSEC-2026-47"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-shjc-2j68-2yfy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37272?format=json","vulnerability_id":"VCID-tktt-vg92-6kae","summary":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"2.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/49222?format=json","purl":"pkg:pypi/django@5.2.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13"},{"url":"http://public2.vulnerablecode.io/api/packages/49223?format=json","purl":"pkg:pypi/django@6.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4"}],"aliases":["CVE-2026-4292","PYSEC-2026-53"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tktt-vg92-6kae"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37268?format=json","vulnerability_id":"VCID-tuqc-c251-h7ds","summary":"An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/49222?format=json","purl":"pkg:pypi/django@5.2.13","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.13"},{"url":"http://public2.vulnerablecode.io/api/packages/49223?format=json","purl":"pkg:pypi/django@6.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-m4am-h2ea-3ffr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.4"}],"aliases":["CVE-2026-33033","PYSEC-2026-48"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-tuqc-c251-h7ds"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37201?format=json","vulnerability_id":"VCID-wa3g-27sx-mbcw","summary":"An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1287","reference_id":"CVE-2026-1287","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1287"},{"reference_url":"https://github.com/advisories/GHSA-gvg8-93h5-g6qq","reference_id":"GHSA-gvg8-93h5-g6qq","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-gvg8-93h5-g6qq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/47228?format=json","purl":"pkg:pypi/django@5.2.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/47229?format=json","purl":"pkg:pypi/django@6.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@6.0.2"}],"aliases":["CVE-2026-1287","GHSA-gvg8-93h5-g6qq","PYSEC-2026-46"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wa3g-27sx-mbcw"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37152?format=json","vulnerability_id":"VCID-7c5n-nzwk-v7bz","summary":"An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\n`FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/479415ce5249bcdebeb6570c72df2a87f45a7bbf"},{"reference_url":"https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/56aea00c3c5e1aacf4ed05f8ee06c2e78f02cea0"},{"reference_url":"https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/5b90ca1e7591fa36fccf2d6dad67cf1477e6293e"},{"reference_url":"https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/9c6a5bde24240382807d13bc3748d08444709355"},{"reference_url":"https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/f997037b235f6b5c9e7c4a501491ec45f3400f3d"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13372","reference_id":"CVE-2025-13372","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13372"},{"reference_url":"https://github.com/advisories/GHSA-rqw2-ghq9-44m7","reference_id":"GHSA-rqw2-ghq9-44m7","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rqw2-ghq9-44m7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46601?format=json","purl":"pkg:pypi/django@4.2.27","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4kcg-gx5y-cuaw"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-jybd-p65h-xffy"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-r1vx-vv7d-gqaj"},{"vulnerability":"VCID-shch-yusm-1uck"},{"vulnerability":"VCID-shjc-2j68-2yfy"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"},{"vulnerability":"VCID-wa3g-27sx-mbcw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.27"},{"url":"http://public2.vulnerablecode.io/api/packages/46602?format=json","purl":"pkg:pypi/django@5.1.15","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.15"},{"url":"http://public2.vulnerablecode.io/api/packages/46603?format=json","purl":"pkg:pypi/django@5.2.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4kcg-gx5y-cuaw"},{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-jybd-p65h-xffy"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-r1vx-vv7d-gqaj"},{"vulnerability":"VCID-shch-yusm-1uck"},{"vulnerability":"VCID-shjc-2j68-2yfy"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"},{"vulnerability":"VCID-wa3g-27sx-mbcw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9"}],"aliases":["CVE-2025-13372","GHSA-rqw2-ghq9-44m7","PYSEC-2025-104"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7c5n-nzwk-v7bz"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37153?format=json","vulnerability_id":"VCID-fcg9-xypn-ykhf","summary":"An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.\nAlgorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XML `Deserializer`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.","references":[{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security","reference_id":"","reference_type":"","scores":[],"url":"https://docs.djangoproject.com/en/dev/releases/security"},{"reference_url":"https://docs.djangoproject.com/en/dev/releases/security/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"reference_url":"https://github.com/django/django","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django"},{"reference_url":"https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/0db9ea4669312f1f4973e09f4bca06ab9c1ec74b"},{"reference_url":"https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/1dbd07a608e495a0c229edaaf84d58d8976313b5"},{"reference_url":"https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0"},{"reference_url":"https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/django/django/commit/99e7d22f55497278d0bcb2e15e72ef532e62a31d"},{"reference_url":"https://groups.google.com/g/django-announce","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://groups.google.com/g/django-announce"},{"reference_url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases","reference_id":"","reference_type":"","scores":[],"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases"},{"reference_url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://www.djangoproject.com/weblog/2025/dec/02/security-releases/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64460","reference_id":"CVE-2025-64460","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64460"},{"reference_url":"https://github.com/advisories/GHSA-vrcr-9hj9-jcg6","reference_id":"GHSA-vrcr-9hj9-jcg6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-vrcr-9hj9-jcg6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46601?format=json","purl":"pkg:pypi/django@4.2.27","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4kcg-gx5y-cuaw"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-jybd-p65h-xffy"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-r1vx-vv7d-gqaj"},{"vulnerability":"VCID-shch-yusm-1uck"},{"vulnerability":"VCID-shjc-2j68-2yfy"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"},{"vulnerability":"VCID-wa3g-27sx-mbcw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.27"},{"url":"http://public2.vulnerablecode.io/api/packages/46602?format=json","purl":"pkg:pypi/django@5.1.15","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.15"},{"url":"http://public2.vulnerablecode.io/api/packages/46603?format=json","purl":"pkg:pypi/django@5.2.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4kcg-gx5y-cuaw"},{"vulnerability":"VCID-abpe-htm1-9ubp"},{"vulnerability":"VCID-eqsc-axng-ckca"},{"vulnerability":"VCID-ga7z-wj4j-63h1"},{"vulnerability":"VCID-jybd-p65h-xffy"},{"vulnerability":"VCID-kxdd-yzp3-r7cb"},{"vulnerability":"VCID-m4am-h2ea-3ffr"},{"vulnerability":"VCID-phkp-9abp-f3dq"},{"vulnerability":"VCID-r1vx-vv7d-gqaj"},{"vulnerability":"VCID-shch-yusm-1uck"},{"vulnerability":"VCID-shjc-2j68-2yfy"},{"vulnerability":"VCID-tktt-vg92-6kae"},{"vulnerability":"VCID-tuqc-c251-h7ds"},{"vulnerability":"VCID-wa3g-27sx-mbcw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9"}],"aliases":["CVE-2025-64460","GHSA-vrcr-9hj9-jcg6","PYSEC-2025-109"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fcg9-xypn-ykhf"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.9"}