{"schema_version":1,"title":"Django (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 172 vulnerabilities in Django (PyPI): 1 in the last 7 days and 12 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71461, was published on 23 September 2026.","url":"https://junglewise.ai/threats/technologies/django","json_url":"https://junglewise.ai/threats/technologies/django.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/django","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":11,"all_time":172,"critical":1,"exploited":0,"last_7_days":1,"last_30_days":1,"last_90_days":12,"last_365_days":37},"latest":[{"cve":"CVE-2026-71461","cvss":4.3,"epss":0.0021,"slug":"cve-2026-71461-hostlist-list-catches-bare-exception-and-returns-str-e-verbatim","title":"Django HostList.list() information disclosure via unhandled exception","severity":"medium","exploited":false,"published_at":"2026-09-23T19:19:02.953+00:00","url":"https://junglewise.ai/threats/cve-2026-71461-hostlist-list-catches-bare-exception-and-returns-str-e-verbatim"},{"cve":"CVE-2026-15830","cvss":5.3,"epss":0.0076,"slug":"cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service","title":"Django GeoDjango unbounded recursion denial of service","severity":"medium","exploited":false,"published_at":"2026-08-04T17:16:46.593+00:00","url":"https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service"},{"cve":"CVE-2026-25674","cvss":3.1,"epss":0.0033,"slug":"cve-2026-25674-django-has-a-race-condition-vulnerability","title":"PYSEC-2026-2449 - Django has a Race Condition vulnerability","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:40.566428+00:00","url":"https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability"},{"cve":"CVE-2025-59682","cvss":3.1,"epss":0.0091,"slug":"cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives","title":"PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:06.157235+00:00","url":"https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives"},{"cve":"CVE-2026-53878","cvss":6.1,"epss":0.0033,"slug":"cve-2026-53878-django-domainnamevalidator-header-injection-via-newline","title":"Django DomainNameValidator header injection via newline characters","severity":"medium","exploited":false,"published_at":"2026-07-07T15:16:48.583+00:00","url":"https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline"},{"cve":"CVE-2026-53877","cvss":4.8,"epss":0.0044,"slug":"cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component","title":"Django GDALRaster heap buffer over-read in GIS component","severity":"medium","exploited":false,"published_at":"2026-07-07T15:16:48.453+00:00","url":"https://junglewise.ai/threats/cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component"},{"cve":"CVE-2026-48588","cvss":3.1,"epss":0.0043,"slug":"cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching","title":"Django private data exposure in UpdateCacheMiddleware caching","severity":"low","exploited":false,"published_at":"2026-07-07T15:16:47.447+00:00","url":"https://junglewise.ai/threats/cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching"},{"cve":"CVE-2024-45231","cvss":3.1,"epss":0.0079,"slug":"cve-2024-45231-django-allows-enumeration-of-user-e-mail-addresses","title":"PYSEC-2026-1297 - Django allows enumeration of user e-mail addresses","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:42.697597+00:00","url":"https://junglewise.ai/threats/cve-2024-45231-django-allows-enumeration-of-user-e-mail-addresses"},{"cve":"CVE-2013-1664","epss":0.049,"slug":"cve-2013-1664-xml-entity-expansion-xee-in-django","title":"PYSEC-2026-801 - XML Entity Expansion (XEE) in Django","severity":"info","exploited":false,"published_at":"2026-07-06T08:03:27.156164+00:00","url":"https://junglewise.ai/threats/cve-2013-1664-xml-entity-expansion-xee-in-django"},{"cve":"CVE-2013-1665","epss":0.0463,"slug":"cve-2013-1665-xml-external-entity-xxe-in-django","title":"PYSEC-2026-802 - XML External Entity (XXE) in Django","severity":"info","exploited":false,"published_at":"2026-07-06T08:03:27.102866+00:00","url":"https://junglewise.ai/threats/cve-2013-1665-xml-external-entity-xxe-in-django"},{"cve":"CVE-2007-0404","epss":0.0165,"slug":"cve-2007-0404-django-arbitrary-code-execution","title":"PYSEC-2026-630 - Django Arbitrary Code Execution","severity":"info","exploited":false,"published_at":"2026-07-02T14:13:20.006998+00:00","url":"https://junglewise.ai/threats/cve-2007-0404-django-arbitrary-code-execution"},{"cve":"CVE-2007-0405","epss":0.0126,"slug":"cve-2007-0405-django-improper-access-control","title":"PYSEC-2026-629 - Django Improper Access Control","severity":"info","exploited":false,"published_at":"2026-07-02T14:13:19.912742+00:00","url":"https://junglewise.ai/threats/cve-2007-0405-django-improper-access-control"},{"cve":"CVE-2026-8404","cvss":3.1,"epss":0.0043,"slug":"cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case","title":"Django UpdateCacheMiddleware information disclosure via case-sensitive headers","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:47.65+00:00","url":"https://junglewise.ai/threats/cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case"},{"cve":"CVE-2026-7666","cvss":4,"epss":0.0021,"slug":"cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend","title":"Django cleartext email transmission in SMTP EmailBackend","severity":"medium","exploited":false,"published_at":"2026-06-03T14:16:47.087+00:00","url":"https://junglewise.ai/threats/cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend"},{"cve":"CVE-2026-6873","cvss":3.1,"epss":0.0028,"slug":"cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie","title":"Django salt namespace collision in get_signed_cookie","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:46.483+00:00","url":"https://junglewise.ai/threats/cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie"},{"cve":"CVE-2026-48587","cvss":3.1,"epss":0.0043,"slug":"cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary","title":"Django information disclosure via whitespace padding in Vary header","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:44.983+00:00","url":"https://junglewise.ai/threats/cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary"},{"cve":"CVE-2026-35193","cvss":4,"epss":0.0043,"slug":"cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing","title":"Django UpdateCacheMiddleware information disclosure via missing Vary header","severity":"medium","exploited":false,"published_at":"2026-06-03T14:16:41.247+00:00","url":"https://junglewise.ai/threats/cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing"},{"cve":"CVE-2026-5766","cvss":5.3,"epss":0.0052,"slug":"cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi","title":"Django Improper Handling of Length Parameter Inconsistency in ASGI requests","severity":"medium","exploited":false,"published_at":"2026-05-05T18:33:26+00:00","url":"https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi"},{"cve":"CVE-2026-6907","cvss":4.3,"epss":0.0044,"slug":"cve-2026-6907-django-incorrect-caching-of-sensitive-information-in","title":"Django incorrect caching of sensitive information in UpdateCacheMiddleware","severity":"medium","exploited":false,"published_at":"2026-05-05T18:33:26+00:00","url":"https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in"},{"cve":"CVE-2026-35192","cvss":4,"epss":0.0069,"slug":"cve-2026-35192-django-session-leakage-via-public-cached-pages","title":"Django session leakage via public cached pages","severity":"medium","exploited":false,"published_at":"2026-05-05T18:33:24+00:00","url":"https://junglewise.ai/threats/cve-2026-35192-django-session-leakage-via-public-cached-pages"},{"cve":"CVE-2026-4292","cvss":3.1,"epss":0.0036,"slug":"cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable","title":"Django privilege abuse in ModelAdmin.list_editable","severity":"low","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0055,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2026-4277","cvss":4,"epss":0.006,"slug":"cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin","title":"Django missing authorization in GenericInlineModelAdmin","severity":"medium","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0085,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:51+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-33033","cvss":6.5,"epss":0.0088,"slug":"cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads","title":"Django DoS in MultiPartParser via crafted multipart uploads","severity":"medium","exploited":false,"published_at":"2026-04-07T15:30:51+00:00","url":"https://junglewise.ai/threats/cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":7},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"related":[{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/picklescan"},{"name":"openbabel (PyPI)","slug":"openbabel","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/openbabel"},{"name":"apache-superset (PyPI)","slug":"apache-superset","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/apache-superset"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"weblate (PyPI)","slug":"weblate","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/weblate"},{"name":"mcp-atlassian (PyPI)","slug":"mcp-atlassian","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/mcp-atlassian"},{"name":"crawl4ai (PyPI)","slug":"crawl4ai","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/crawl4ai"},{"name":"moin (PyPI)","slug":"moin","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/moin"}],"technology":{"hub":true,"name":"Django (PyPI)","slug":"django","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://www.djangoproject.com/","repo_url":"https://github.com/django/django","description":"A high-level Python web framework that encourages rapid development and clean, pragmatic design.","url":"https://junglewise.ai/threats/technologies/django"},"most_severe":[{"cve":"CVE-2025-64459","cvss":9.1,"epss":0.194,"slug":"cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector","title":"Django SQL injection in QuerySet and Q objects via _connector argument","severity":"critical","exploited":false,"published_at":"2025-11-05T15:31:07+00:00","url":"https://junglewise.ai/threats/cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector"},{"cve":"CVE-2020-9402","cvss":8.8,"epss":0.2251,"slug":"cve-2020-9402-django-sql-injection-in-gis-functions-for-oracle","title":"Django SQL injection in GIS functions for Oracle","severity":"high","exploited":false,"published_at":"2020-06-05T14:52:07+00:00","url":"https://junglewise.ai/threats/cve-2020-9402-django-sql-injection-in-gis-functions-for-oracle"},{"cve":"CVE-2010-4535","cvss":7.5,"epss":0.0341,"slug":"cve-2010-4535-django-denial-of-service-in-password-reset-timestamp-handling","title":"Django denial of service in password reset timestamp handling","severity":"high","exploited":false,"published_at":"2018-07-23T19:51:59+00:00","url":"https://junglewise.ai/threats/cve-2010-4535-django-denial-of-service-in-password-reset-timestamp-handling"},{"cve":"CVE-2025-64458","cvss":7.5,"epss":0.019,"slug":"cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows","title":"Django denial of service in HttpResponseRedirect on Windows","severity":"high","exploited":false,"published_at":"2025-11-05T15:31:07+00:00","url":"https://junglewise.ai/threats/cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows"},{"cve":"CVE-2011-0696","cvss":7.5,"epss":0.016,"slug":"cve-2011-0696-django-csrf-protection-bypass-via-x-requested-with-header","title":"Django CSRF protection bypass via X-Requested-With header","severity":"high","exploited":false,"published_at":"2018-07-23T19:51:10+00:00","url":"https://junglewise.ai/threats/cve-2011-0696-django-csrf-protection-bypass-via-x-requested-with-header"},{"cve":"CVE-2026-25673","cvss":7.5,"epss":0.011,"slug":"cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on","title":"Django denial of service in URLField via Unicode normalization on Windows","severity":"high","exploited":false,"published_at":"2026-03-03T15:16:19.103+00:00","url":"https://junglewise.ai/threats/cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0085,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:51+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0055,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2025-57833","cvss":7.1,"epss":0.1676,"slug":"cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases","title":"Django SQL injection in FilteredRelation column aliases","severity":"high","exploited":false,"published_at":"2025-09-08T18:31:31+00:00","url":"https://junglewise.ai/threats/cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases"},{"cve":"CVE-2025-59681","cvss":7.1,"epss":0.0063,"slug":"cve-2025-59681-django-sql-injection-in-column-aliases-on-mysql-and-mariadb","title":"Django SQL injection in column aliases on MySQL and MariaDB","severity":"high","exploited":false,"published_at":"2025-10-01T21:31:21+00:00","url":"https://junglewise.ai/threats/cve-2025-59681-django-sql-injection-in-column-aliases-on-mysql-and-mariadb"}],"generated_at":"2026-09-26T18:07:00.158435+00:00"}