CRITICAL9.8CVE-2026-4277Privilege abuse in GenericInlineModelAdmin >= 4.2.0, < 4.2.30, >= 5.2.0, < 5.2.13, >= 6.0.0, < 6.0.4
CRITICAL9.8CVE-2024-53908Django SQL injection in HasKey(lhs, rhs) on Oracle >= 4.2.0, < 4.2.17, >= 5.0.0, < 5.1.4
>= 3.2.0, < 3.2.19, >= 4.0.0, < 4.1.9 | >= 4.2.0, <= 4.2.0
CRITICAL9.8Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
>= 3.2.0, < 3.2.14, >= 4.0.0, < 4.0.6
CRITICAL9.8python-django - security update
>= 2.2.0, < 2.2.28, >= 3.2.0, < 3.2.13, >= 4.0.0, < 4.0.4
CRITICAL9.8SQL Injection in Django
>= 2.2.0, < 2.2.28, >= 3.2.0, < 3.2.13, >= 4.0.0, < 4.0.4
CRITICAL9.8SQL Injection in Django
>= 3.1.0, < 3.1.13, >= 3.2.0, < 3.2.5
CRITICAL9.8python-django - security update
>= 1.11.0, < 1.11.28, >= 2.2.0, < 2.2.10, >= 3.0.0, < 3.0.3
CRITICAL9.1Potential SQL injection via _connector keyword argument in QuerySet and Q objects
>= 4.2.0, < 4.2.26, >= 5.1.0, < 5.1.14, >= 5.2.0, < 5.2.8
CRITICAL9.1Django SQL injection vulnerability
>= 4.2.0, < 4.2.15, >= 5.0.0, < 5.0.8
HIGH8.8Django vulnerable to Reflected File Download attack
>= 3.2.0, < 3.2.15, >= 4.0.0, < 4.0.7
HIGH8.8python-django - security update
>= 1.11.0, < 1.11.29, >= 2.2.0, < 2.2.11, >= 3.0.0, < 3.0.4
HIGH7.5ASGI header spoofing via underscore/hyphen conflation
>= 4.2.0, < 4.2.30, >= 5.2.0, < 5.2.13, >= 6.0.0, < 6.0.4
HIGH7.5Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
>= 4.2.0, < 4.2.30, >= 5.2.0, < 5.2.13, >= 6.0.0, < 6.0.4
HIGH7.5Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows
>= 4.2.0, < 4.2.29, >= 5.2.0, < 5.2.12, >= 6.0.0, < 6.0.3
HIGH7.5Potential denial-of-service vulnerability via repeated headers when using ASGI
>= 4.2.0, < 4.2.28, >= 5.2.0, < 5.2.11, >= 6.0.0, < 6.0.2
HIGH7.5Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
>= 4.2.0, < 4.2.28, >= 5.2.0, < 5.2.11, >= 6.0.0, < 6.0.2
HIGH7.5Potential denial-of-service vulnerability in XML serializer text extraction
>= 4.2.0, < 4.2.27, >= 5.1.0, < 5.1.15, >= 5.2.0, < 5.2.9
HIGH7.5Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
>= 4.2.0, < 4.2.26, >= 5.1.0, < 5.1.14, >= 5.2.0, < 5.2.8
HIGH7.5python-django - security update
>= 4.2.0, < 4.2.17, >= 5.0.0, < 5.1.4
HIGH7.5Django vulnerable to Denial of Service
>= 4.2.0, < 4.2.14, >= 5.0.0, < 5.0.7
HIGH7.5Django Path Traversal vulnerability
>= 4.2.0, < 4.2.14, >= 5.0.0, < 5.0.7
HIGH7.5Django vulnerable to Denial of Service
>= 4.2.0, < 4.2.14, >= 5.0.0, < 5.0.7
HIGH7.5Django potential denial of service vulnerability in UsernameField on Windows
>= 3.2.0, < 3.2.23, >= 4.1.0, < 4.1.13, >= 4.2.0, < 4.2.7
HIGH7.5python-django - security update
>= 3.2.0, < 3.2.20, >= 4.0.0, < 4.1.10, >= 4.2.0, < 4.2.3
HIGH7.5python-django - security update
>= 3.2.0, < 3.2.18, >= 4.0.0, < 4.0.10, >= 4.1.0, < 4.1.7
HIGH7.5python-django - security update
>= 3.2.0, < 3.2.17, >= 4.0.0, < 4.0.9, >= 4.1.0, < 4.1.6
HIGH7.5Django denial-of-service vulnerability in internationalized URLs
>= 3.2.0, < 3.2.16, >= 4.0.0, < 4.0.8, >= 4.1.0, < 4.1.2
HIGH7.5Infinite Loop in Django
>= 2.2.0, < 2.2.27, >= 3.2.0, < 3.2.12, >= 4.0.0, < 4.0.2
HIGH7.5Information disclosure in Django
>= 2.2.0, < 2.2.26, >= 3.2.0, < 3.2.11, >= 4.0.0, < 4.0.1
HIGH7.5python-django - security update
>= 2.2.0, < 2.2.26, >= 3.2.0, < 3.2.11, >= 4.0.0, < 4.0.1
HIGH7.5Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
>= 2.2.0, < 2.2.24, >= 3.0.0, < 3.1.12, >= 3.2.0, < 3.2.4
HIGH7.5python-django - security update
>= 2.2.0, < 2.2.21, >= 3.1.0, < 3.1.9, >= 3.2.0, < 3.2.1
HIGH7.5python-django - security update
>= 2.2.0, < 2.2.16, >= 3.0.0, < 3.0.10, >= 3.1.0, < 3.1.1
HIGH7.5Django Incorrect Default Permissions
>= 2.2.0, < 2.2.16, >= 3.0.0, < 3.0.10, >= 3.1.0, < 3.1.1
HIGH7.3Potential bypass of an upstream access control based on URL paths in Django
>= 2.2.0, < 2.2.25, >= 3.1.0, < 3.1.14, >= 3.2.0, < 3.2.10
HIGH7.1python-django - security update
>= 4.2.0, < 4.2.25, >= 5.1.0, < 5.1.13, >= 5.2.0, < 5.2.7
HIGH7.1python-django - security update
>= 4.2.0, < 4.2.24, >= 5.1.0, < 5.1.12, >= 5.2.0, < 5.2.6
MEDIUM6.5Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
>= 5.2.0, < 5.2.14, >= 6.0.0, < 6.0.5
MEDIUM6.5Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload
>= 4.2.0, < 4.2.30, >= 5.2.0, < 5.2.13, >= 6.0.0, < 6.0.4
MEDIUM6.5Django vulnerable to partial directory traversal via archives
>= 4.2.0, < 4.2.25, >= 5.1.0, < 5.1.13, >= 5.2.0, < 5.2.7
MEDIUM6.1python-django - security update
>= 2.2.0, < 2.2.27, >= 3.2.0, < 3.2.12, >= 4.0.0, < 4.0.2
MEDIUM6.1Header injection possible in Django
>= 2.2.0, < 2.2.22, >= 3.1.0, < 3.1.10, >= 3.2.0, < 3.2.2
MEDIUM6.1XSS in Django
>= 2.2.0, < 2.2.13, >= 3.0.0, < 3.0.7
MEDIUM5.9Django denial-of-service attack in the intcomma template filter
>= 3.2.0, < 3.2.24, >= 4.2.0, < 4.2.10, >= 5.0.0, < 5.0.2
MEDIUM5.9Django Denial-of-service in django.utils.text.Truncator
>= 3.2.0, < 3.2.22, >= 4.1.0, < 4.1.12, >= 4.2.0, < 4.2.6
MEDIUM5.9Web Cache Poisoning
>= 2.2.0, < 2.2.19, >= 3.0.0, < 3.0.13, >= 3.1.0, < 3.1.7
MEDIUM5.9python-django - security update
>= 2.2.0, < 2.2.13, >= 3.0.0, < 3.0.7
MEDIUM5.8Django Potential Denial of Service (DoS) on Windows
>= 5.0.0, < 5.0.14, >= 5.1.0, < 5.1.8
MEDIUM5.8python-django - security update
>= 4.2.0, < 5.1.5
MEDIUM5.4Potential SQL injection in column aliases via control characters
>= 4.2.0, < 4.2.28, >= 5.2.0, < 5.2.11, >= 6.0.0, < 6.0.2
MEDIUM5.4Potential SQL injection via QuerySet.order_by and FilteredRelation
>= 4.2.0, < 4.2.28, >= 5.2.0, < 5.2.11, >= 6.0.0, < 6.0.2
MEDIUM5.4Potential SQL injection via raster lookups on PostGIS
>= 4.2.0, < 4.2.28, >= 5.2.0, < 5.2.11, >= 6.0.0, < 6.0.2
MEDIUM5.3Potential exposure of private data via cached Set-Cookie response
>= 5.2.0, < 5.2.16, >= 6.0.0, < 6.0.7
MEDIUM5.3Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
>= 5.2.0, < 5.2.15, >= 6.0.0, < 6.0.6
MEDIUM5.3Potential exposure of private data via whitespace padding in Vary header
>= 5.2.0, < 5.2.15, >= 6.0.0, < 6.0.6
MEDIUM5.3Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass
>= 5.2.0, < 5.2.14, >= 6.0.0, < 6.0.5
MEDIUM5.3Username enumeration through timing difference in mod_wsgi authentication handler
>= 4.2.0, < 4.2.28, >= 5.2.0, < 5.2.11, >= 6.0.0, < 6.0.2
MEDIUM5.3Django has a denial-of-service possibility in strip_tags()
>= 4.2.0, < 4.2.21, >= 5.1.0, < 5.1.9, >= 5.2.0, < 5.2.5
MEDIUM5.3Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters
>= 4.2.0, < 4.2.16, >= 5.0.0, < 5.0.9, >= 5.1.0, < 5.2.5
MEDIUM5.3Django allows enumeration of user e-mail addresses
>= 4.2.0, < 4.2.16, >= 5.0.0, < 5.0.9, >= 5.1.0, < 5.2.5
MEDIUM5.3Django memory consumption vulnerability
>= 4.2.0, < 4.2.15, >= 5.0.0, < 5.0.8
MEDIUM5.3Django vulnerable to a denial-of-service attack
>= 4.2.0, < 4.2.15, >= 5.0.0, < 5.0.8
MEDIUM5.3Django vulnerable to denial-of-service attack
>= 4.2.0, < 4.2.15, >= 5.0.0, < 5.0.8
MEDIUM5.3python-django - security update
>= 4.2.0, < 4.2.14, >= 5.0.0, < 5.0.7
MEDIUM5.3Regular expression denial-of-service in Django
>= 3.2.0, < 3.2.25, >= 4.2.0, < 4.2.11, >= 5.0.0, < 5.0.3
MEDIUM5.3python-django - security update
>= 3.2.0, < 3.2.21, >= 4.1.0, < 4.1.11, >= 4.2.0, < 4.2.5
MEDIUM5.3python-django - security update
>= 2.2.0, < 2.2.26, >= 3.2.0, < 3.2.11, >= 4.0.0, < 4.0.1
MEDIUM5.3python-django - security update
>= 2.2.0, < 2.2.20, >= 3.0.0, < 3.0.14, >= 3.1.0, < 3.1.8
MEDIUM5.3python-django - security update
>= 2.2.0, < 2.2.18, >= 3.0.0, < 3.0.12, >= 3.1.0, < 3.1.6
MEDIUM5.0python-django - security update
>= 4.2.0, < 5.1.7
MEDIUM4.9python-django - security update
from 0, < 2.2.24, >= 3.0.0, < 3.1.12, >= 3.2.0, < 3.2.4
MEDIUM4.3Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie
>= 5.2.0, < 5.2.15, >= 6.0.0, < 6.0.6
MEDIUM4.3Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware
>= 5.2.0, < 5.2.14, >= 6.0.0, < 6.0.5
MEDIUM4.3Potential SQL injection in FilteredRelation column aliases on PostgreSQL
>= 4.2.0, < 4.2.27, >= 5.1.0, < 5.1.15, >= 5.2.0, < 5.2.9
MEDIUM4.0Django Improper Output Neutralization for Logs vulnerability
>= 4.2.0, < 4.2.23, >= 5.1.0, < 5.1.11, >= 5.2.0, < 5.2.3
LOW3.7Potential incorrect permissions on newly created file system objects
>= 4.2.0, < 4.2.29, >= 5.2.0, < 5.2.12, >= 6.0.0, < 6.0.3
LOW2.7Privilege abuse in ModelAdmin.list_editable
>= 4.2.0, < 4.2.30, >= 5.2.0, < 5.2.13, >= 6.0.0, < 6.0.4
—Header injection possibility since DomainNameValidator accepted newlines in input
>= 5.2.0, < 5.2.16, >= 6.0.0, < 6.0.7
—Heap buffer over-read in GDALRaster
>= 5.2.0, < 5.2.16, >= 6.0.0, < 6.0.7
—Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
>= 5.2.0, < 5.2.15, >= 6.0.0, < 6.0.6