{"kind": "product", "path": "vulns/debian-12/python-django", "name": "python-django", "product": "python-django", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-87975", "noindex": false, "published": "2026-10-06T13:35:59.505Z", "modified": "2026-10-06T13:53:32.999Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00228, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-87975", "title": "Privilege abuse in model formsets with editable primary keys", "description": "An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's ", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/83cbd21be57483e6b3eb6e4688a561c841aff75e"], "fixes": ["3:3.2.25-0+deb12u6"], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-84429", "noindex": false, "published": "2026-10-06T13:35:17.443Z", "modified": "2026-10-06T14:15:10.916Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00483, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-84429", "title": "Potential denial-of-service vulnerability in HTTP header parsing", "description": "An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and ma", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/7ff7fcc0508864a4bc39693128ace38b1e95a890"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-77050", "noindex": false, "published": "2026-10-06T13:34:40.107Z", "modified": "2026-10-06T14:21:29.655Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00483, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77050", "title": "Potential denial-of-service vulnerability in get_supported_language_variant()", "description": "An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.utils.translation.get_supported_language_variant()` is subject to\r\na potential denial-of-service attack when processing many distinct, very long\r\nlanguage codes, which are retained as keys in an in-memory cache and\r\nconsume process memory.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Gleb Lizunov for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/c88b304cc2d90fc37d3bd1f5f3829706fa6c13bc"], "fixes": ["3:3.2.25-0+deb12u6"], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-15920", "noindex": false, "published": "2026-08-04T15:48:40.537Z", "modified": "2026-08-04T17:21:13.428Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00354, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-15920", "title": "Potential cross-site scripting via URLField values in the admin", "description": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example thr", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"], "fixes": ["3:3.2.25-0+deb12u4"], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-15830", "noindex": false, "published": "2026-08-04T15:48:34.075Z", "modified": "2026-10-08T10:58:22.401Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.01113, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-15830", "title": "Potential denial-of-service vulnerability via nested geometry collections", "description": "An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18.\nGeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Andrew MacP", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/d2e59b77fe18de318a8272c2a7bbc798d84d1d0d"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-15337", "noindex": false, "published": "2026-08-04T15:48:25.817Z", "modified": "2026-08-04T17:21:43.493Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0059, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-15337", "title": "Potential denial-of-service vulnerability in check_for_language()", "description": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.\nEarlier, unsupported Django series (such as 5.1.x, 5.0", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/27137e655e442e81095f1f8f77ff3870d9fdf169"], "fixes": ["3:3.2.25-0+deb12u4"], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-15307", "noindex": false, "published": "2026-08-04T15:48:18.829Z", "modified": "2026-08-05T03:57:15.862Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01134, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-15307", "title": "Server-side file-write and request forgery via spatial lookups", "description": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an ", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-53877", "noindex": false, "published": "2026-07-07T14:10:04.025Z", "modified": "2026-07-07T14:59:07.106Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00527, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-53877", "title": "Heap buffer over-read in GDALRaster", "description": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-48588", "noindex": false, "published": "2026-07-07T14:09:32.687Z", "modified": "2026-07-07T14:59:53.337Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00429, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48588", "title": "Potential exposure of private data via cached Set-Cookie response", "description": "An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.\n`UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Chris Whyland for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jul/07/security-releases/"], "fixes": ["3:3.2.25-0+deb12u5"], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-48587", "noindex": false, "published": "2026-06-03T13:16:47.811Z", "modified": "2026-06-03T15:47:55.165Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48587", "title": "Potential exposure of private data via whitespace padding in Vary header", "description": "An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Navid Rezazadeh for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jun/03/security-releases/"], "fixes": ["3:3.2.25-0+deb12u5"], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-35193", "noindex": false, "published": "2026-06-03T13:16:38.456Z", "modified": "2026-06-03T15:47:18.140Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35193", "title": "Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware", "description": "An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Shai Berger for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jun/03/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-8404", "noindex": false, "published": "2026-06-03T13:16:29.593Z", "modified": "2026-06-03T15:46:40.439Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-8404", "title": "Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware", "description": "An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.\n`django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmed Badawe for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jun/03/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-7666", "noindex": false, "published": "2026-06-03T13:16:15.446Z", "modified": "2026-06-03T15:43:34.012Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.0015, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-7666", "title": "Potential unencrypted email transmission via STARTTLS in the SMTP backend", "description": "An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kasper Dupont for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jun/03/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-6873", "noindex": false, "published": "2026-06-03T13:16:03.924Z", "modified": "2026-06-03T15:43:58.829Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00245, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6873", "title": "Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie", "description": "An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.\n`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Peng Zhou for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/jun/03/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-35192", "noindex": false, "published": "2026-05-05T14:50:29.984Z", "modified": "2026-05-06T15:25:28.432Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00544, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-35192", "title": "Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST", "description": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nResponse headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/may/05/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-6907", "noindex": false, "published": "2026-05-05T14:50:02.594Z", "modified": "2026-05-06T15:25:33.698Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00358, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6907", "title": "Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware", "description": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\n`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Ahmad Sadeddin for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/may/05/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-5766", "noindex": false, "published": "2026-05-05T14:49:19.715Z", "modified": "2026-05-06T15:25:38.926Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00423, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5766", "title": "Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass", "description": "An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.\nASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation.\r\n \r\nAs a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Kyle Agronick for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/may/05/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-33034", "noindex": false, "published": "2026-04-07T14:22:59.942Z", "modified": "2026-04-07T20:44:01.819Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00769, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33034", "title": "Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass", "description": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nASGI requests with a missing or understated `Content-Length` header could\r\nbypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit when reading\r\n`HttpRequest.body`, allowing remote attackers to load an unbounded request body into\r\nmemory.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Superior for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-33033", "noindex": false, "published": "2026-04-07T14:22:48.624Z", "modified": "2026-04-07T15:21:27.926Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00879, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33033", "title": "Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload", "description": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\n`MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seokchan Yoon for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-4292", "noindex": false, "published": "2026-04-07T14:22:38.254Z", "modified": "2026-04-07T15:12:56.065Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-4292", "title": "Privilege abuse in ModelAdmin.list_editable", "description": "An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.\nAdmin changelist forms using `ModelAdmin.list_editable` incorrectly allowed new\r\ninstances to be created via forged `POST` data.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Cantina for reporting this issue.", "references": ["https://docs.djangoproject.com/en/dev/releases/security/", "https://groups.google.com/g/django-announce", "https://www.djangoproject.com/weblog/2026/apr/07/security-releases/"], "fixes": [], "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}]}], "total": 159, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 8, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "python-django", "path": "vulns/debian-12/python-django", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 3, "kev": 0}, "lastmod": "2026-10-08T10:58:22.401Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}