What’s Vulnerable › Products
Django vulnerabilities
161 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 39 published in the last 12 months.
Check whether your Django version is affected
Latest Django vulnerabilities
- CVE-2026-87975 — Privilege abuse in model formsets with editable primary keys (CVSS 4.3)
- CVE-2026-87890 — Potential request forgery via spatial lookup byte values (CVSS 5.3)
- CVE-2026-84429 — Potential denial-of-service vulnerability in HTTP header parsing (CVSS 5.3)
- CVE-2026-77050 — Potential denial-of-service vulnerability in get_supported_language_variant() (CVSS 5.3)
- CVE-2026-15920 — Potential cross-site scripting via URLField values in the admin (CVSS 6.1)
- CVE-2026-15830 — Potential denial-of-service vulnerability via nested geometry collections (CVSS 5.3)
- CVE-2026-15337 — Potential denial-of-service vulnerability in check_for_language() (CVSS 5.3)
- CVE-2026-15307 — Server-side file-write and request forgery via spatial lookups (CVSS 8.8)
- CVE-2026-53878 — Header injection possibility since DomainNameValidator accepted newlines in input (CVSS 6.1)
- CVE-2026-53877 — Heap buffer over-read in GDALRaster (CVSS 4.8)
- CVE-2026-48588 — Potential exposure of private data via cached Set-Cookie response (CVSS 5.3)
- CVE-2026-8404 — Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware (CVSS 5.3)
- CVE-2026-7666 — Potential unencrypted email transmission via STARTTLS in the SMTP backend (CVSS 3.1)
- CVE-2026-6873 — Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie (CVSS 4.3)
- CVE-2026-48587 — Potential exposure of private data via whitespace padding in Vary header (CVSS 5.3)
- CVE-2026-35193 — Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware (CVSS 3.1)
- CVE-2026-6907 — Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware (CVSS 5.3)
- CVE-2026-5766 — Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (CVSS 5.3)
- CVE-2026-35192 — Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST (CVSS 6.5)
- CVE-2026-4292 — Privilege abuse in ModelAdmin.list_editable (CVSS 2.7)
- CVE-2026-4277 — Privilege abuse in GenericInlineModelAdmin (CVSS 9.8)
- CVE-2026-3902 — ASGI header spoofing via underscore/hyphen conflation (CVSS 7.5)
- CVE-2026-33034 — Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass (CVSS 7.5)
- CVE-2026-33033 — Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (CVSS 6.5)
- CVE-2026-25674 — Potential incorrect permissions on newly created file system objects (CVSS 3.7)