{"schema_version":1,"title":"Django Software Foundation Django vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 38 vulnerabilities in Django Software Foundation Django: 0 in the last 7 days and 8 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114582, was published on 3 November 2026. 4 vulnerabilities in the last four weeks, level on the four before (4).","url":"https://junglewise.ai/threats/technologies/django-software-foundation-django","json_url":"https://junglewise.ai/threats/technologies/django-software-foundation-django.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/django-software-foundation-django","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":9,"all_time":38,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":4,"last_90_days":8,"last_365_days":34},"latest":[{"cve":"CVE-2026-114582","cvss":5.3,"slug":"cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6","title":"Django GIS spatial reference string injection","severity":"medium","exploited":false,"published_at":"2026-11-03T16:17:19.57+00:00","url":"https://junglewise.ai/threats/cve-2026-114582-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6"},{"cve":"CVE-2026-111362","cvss":5.3,"slug":"cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6","title":"Django SSRF in GeoJSON coordinate reference systems","severity":"medium","exploited":false,"published_at":"2026-11-03T16:17:18.917+00:00","url":"https://junglewise.ai/threats/cve-2026-111362-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6"},{"cve":"CVE-2026-111211","cvss":5.3,"slug":"cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6","title":"Django log injection in BaseGeometryWidget.deserialize()","severity":"medium","exploited":false,"published_at":"2026-11-03T16:17:18.72+00:00","url":"https://junglewise.ai/threats/cve-2026-111211-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-before-6"},{"cve":"CVE-2026-108147","cvss":5.3,"slug":"cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before","title":"Django multipart parser excessive memory consumption via base64 Content-Transfer-Encoding","severity":"medium","exploited":false,"published_at":"2026-11-03T16:17:18.5+00:00","url":"https://junglewise.ai/threats/cve-2026-108147-an-issue-was-discovered-in-django-6-1-before-6-1-3-6-0-4-before"},{"cve":"CVE-2026-87975","cvss":4.3,"slug":"cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0","title":"Django authorization bypass in BaseModelFormSet deletion","severity":"medium","exploited":false,"published_at":"2026-10-06T14:17:47.58+00:00","url":"https://junglewise.ai/threats/cve-2026-87975-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0"},{"cve":"CVE-2026-87890","cvss":5.3,"slug":"cve-2026-87890-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0","title":"Django spatial lookups SSRF via crafted VRT document","severity":"medium","exploited":false,"published_at":"2026-10-06T14:17:47.38+00:00","url":"https://junglewise.ai/threats/cve-2026-87890-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0"},{"cve":"CVE-2026-84429","cvss":5.3,"slug":"cve-2026-84429-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0","title":"Django parse_header_parameters denial of service","severity":"medium","exploited":false,"published_at":"2026-10-06T14:17:46.91+00:00","url":"https://junglewise.ai/threats/cve-2026-84429-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0"},{"cve":"CVE-2026-77050","cvss":5.3,"slug":"cve-2026-77050-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0","title":"Django language code processing denial-of-service","severity":"medium","exploited":false,"published_at":"2026-10-06T14:17:46.017+00:00","url":"https://junglewise.ai/threats/cve-2026-77050-an-issue-was-discovered-in-django-6-1-before-6-1-2-6-0-before-6-0"},{"cve":"CVE-2026-15830","cvss":5.3,"epss":0.0076,"slug":"cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service","title":"Django GeoDjango unbounded recursion denial of service","severity":"medium","exploited":false,"published_at":"2026-08-04T17:16:46.593+00:00","url":"https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service"},{"cve":"CVE-2026-53878","cvss":6.1,"epss":0.0033,"slug":"cve-2026-53878-django-domainnamevalidator-header-injection-via-newline","title":"Django DomainNameValidator header injection via newline characters","severity":"medium","exploited":false,"published_at":"2026-07-07T15:16:48.583+00:00","url":"https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline"},{"cve":"CVE-2026-53877","cvss":4.8,"epss":0.0044,"slug":"cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component","title":"Django GDALRaster heap buffer over-read in GIS component","severity":"medium","exploited":false,"published_at":"2026-07-07T15:16:48.453+00:00","url":"https://junglewise.ai/threats/cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component"},{"cve":"CVE-2026-48588","cvss":3.1,"epss":0.0043,"slug":"cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching","title":"Django private data exposure in UpdateCacheMiddleware caching","severity":"low","exploited":false,"published_at":"2026-07-07T15:16:47.447+00:00","url":"https://junglewise.ai/threats/cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching"},{"cve":"CVE-2026-8404","cvss":3.1,"epss":0.0043,"slug":"cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case","title":"Django UpdateCacheMiddleware information disclosure via case-sensitive headers","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:47.65+00:00","url":"https://junglewise.ai/threats/cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case"},{"cve":"CVE-2026-7666","cvss":4,"epss":0.0021,"slug":"cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend","title":"Django cleartext email transmission in SMTP EmailBackend","severity":"medium","exploited":false,"published_at":"2026-06-03T14:16:47.087+00:00","url":"https://junglewise.ai/threats/cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend"},{"cve":"CVE-2026-6873","cvss":3.1,"epss":0.0028,"slug":"cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie","title":"Django salt namespace collision in get_signed_cookie","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:46.483+00:00","url":"https://junglewise.ai/threats/cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie"},{"cve":"CVE-2026-48587","cvss":3.1,"epss":0.0043,"slug":"cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary","title":"Django information disclosure via whitespace padding in Vary header","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:44.983+00:00","url":"https://junglewise.ai/threats/cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary"},{"cve":"CVE-2026-35193","cvss":4,"epss":0.0043,"slug":"cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing","title":"Django UpdateCacheMiddleware information disclosure via missing Vary header","severity":"medium","exploited":false,"published_at":"2026-06-03T14:16:41.247+00:00","url":"https://junglewise.ai/threats/cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing"},{"cve":"CVE-2026-6907","cvss":4.3,"epss":0.0036,"slug":"cve-2026-6907-django-incorrect-caching-of-sensitive-information-in","title":"Django incorrect caching of sensitive information in UpdateCacheMiddleware","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:18.227+00:00","url":"https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in"},{"cve":"CVE-2026-5766","cvss":5.3,"epss":0.0042,"slug":"cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi","title":"Django Improper Handling of Length Parameter Inconsistency in ASGI requests","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:17.74+00:00","url":"https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi"},{"cve":"CVE-2026-35192","cvss":6.5,"epss":0.0054,"slug":"cve-2026-35192-django-session-leakage-via-public-cached-pages","title":"Django session leakage via public cached pages","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:12.383+00:00","url":"https://junglewise.ai/threats/cve-2026-35192-django-session-leakage-via-public-cached-pages"},{"cve":"CVE-2026-4292","cvss":3.1,"epss":0.0029,"slug":"cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable","title":"Django privilege abuse in ModelAdmin.list_editable","severity":"low","exploited":false,"published_at":"2026-04-07T15:17:46.65+00:00","url":"https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable"},{"cve":"CVE-2026-4277","cvss":9.8,"epss":0.0046,"slug":"cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin","title":"Django missing authorization in GenericInlineModelAdmin","severity":"critical","exploited":false,"published_at":"2026-04-07T15:17:46.5+00:00","url":"https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0044,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:46.353+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0077,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:39.393+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-33033","cvss":6.5,"epss":0.0088,"slug":"cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads","title":"Django DoS in MultiPartParser via crafted multipart uploads","severity":"medium","exploited":false,"published_at":"2026-04-07T15:17:39.22+00:00","url":"https://junglewise.ai/threats/cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Django Software Foundation Django REST framework","slug":"django-rest-framework","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/django-rest-framework"}],"technology":{"hub":true,"name":"Django Software Foundation Django","slug":"django-software-foundation-django","vendor":{"hub":true,"name":"Django Software Foundation","slug":"django-software-foundation","url":"https://junglewise.ai/threats/vendors/django-software-foundation"},"aliases":[],"category":"framework","homepage":"https://www.djangoproject.com","repo_url":"https://github.com/django/django","description":"Python web framework for building applications using the model-view-template architecture.","url":"https://junglewise.ai/threats/technologies/django-software-foundation-django"},"most_severe":[{"cve":"CVE-2026-4277","cvss":9.8,"epss":0.0046,"slug":"cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin","title":"Django missing authorization in GenericInlineModelAdmin","severity":"critical","exploited":false,"published_at":"2026-04-07T15:17:46.5+00:00","url":"https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin"},{"cve":"CVE-2025-64459","cvss":9.1,"epss":0.194,"slug":"cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector","title":"Django SQL injection in QuerySet and Q objects via _connector argument","severity":"critical","exploited":false,"published_at":"2025-11-05T15:31:07+00:00","url":"https://junglewise.ai/threats/cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector"},{"cve":"CVE-2025-64460","cvss":7.5,"epss":0.0209,"slug":"cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction","title":"Django denial of service in XML serializer text extraction","severity":"high","exploited":false,"published_at":"2025-12-02T16:15:56.013+00:00","url":"https://junglewise.ai/threats/cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction"},{"cve":"CVE-2025-64458","cvss":7.5,"epss":0.019,"slug":"cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows","title":"Django denial of service in HttpResponseRedirect on Windows","severity":"high","exploited":false,"published_at":"2025-11-05T15:31:07+00:00","url":"https://junglewise.ai/threats/cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows"},{"cve":"CVE-2026-25673","cvss":7.5,"epss":0.011,"slug":"cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on","title":"Django denial of service in URLField via Unicode normalization on Windows","severity":"high","exploited":false,"published_at":"2026-03-03T15:16:19.103+00:00","url":"https://junglewise.ai/threats/cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0077,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:39.393+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0044,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:46.353+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2025-57833","cvss":7.1,"epss":0.1676,"slug":"cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases","title":"Django SQL injection in FilteredRelation column aliases","severity":"high","exploited":false,"published_at":"2025-09-08T18:31:31+00:00","url":"https://junglewise.ai/threats/cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases"},{"cve":"CVE-2025-59681","cvss":7.1,"epss":0.0063,"slug":"cve-2025-59681-django-sql-injection-in-column-aliases-on-mysql-and-mariadb","title":"Django SQL injection in column aliases on MySQL and MariaDB","severity":"high","exploited":false,"published_at":"2025-10-01T21:31:21+00:00","url":"https://junglewise.ai/threats/cve-2025-59681-django-sql-injection-in-column-aliases-on-mysql-and-mariadb"},{"cve":"CVE-2026-1207","cvss":5.4,"epss":0.1325,"slug":"cve-2026-1207-django-sql-injection-in-rasterfield-lookups-on-postgis","title":"Django SQL injection in RasterField lookups on PostGIS","severity":"high","exploited":false,"published_at":"2026-02-03T15:16:13.433+00:00","url":"https://junglewise.ai/threats/cve-2026-1207-django-sql-injection-in-rasterfield-lookups-on-postgis"}],"generated_at":"2026-11-11T03:07:00.183524+00:00"}