# Django (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/django Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/django.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 173 vulnerabilities in Django (PyPI): 0 in the last 7 days and 1 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71461, was published on 23 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 173 (2 critical, 0 exploited in the wild) ## About Django (PyPI) A high-level Python web framework that encourages rapid development and clean, pragmatic design. ## Latest Django (PyPI) vulnerabilities - [CVE-2026-71461: Django HostList.list() information disclosure via unhandled exception](https://junglewise.ai/threats/cve-2026-71461-hostlist-list-catches-bare-exception-and-returns-str-e-verbatim) (medium, CVSS 4.3, published 23 Sep 2026) - [CVE-2026-15830: Django GeoDjango unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service) (medium, CVSS 5.3, published 4 Aug 2026) - [CVE-2026-15307: Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery) (high, CVSS 8.8, published 4 Aug 2026) - [CVE-2026-25674: PYSEC-2026-2449 - Django has a Race Condition vulnerability](https://junglewise.ai/threats/cve-2026-25674-django-has-a-race-condition-vulnerability) (low, CVSS 3.1, published 13 Jul 2026) - [CVE-2025-59682: PYSEC-2026-1296 - Django vulnerable to partial directory traversal via archives](https://junglewise.ai/threats/cve-2025-59682-django-vulnerable-to-partial-directory-traversal-via-archives) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-53878: Django DomainNameValidator header injection via newline characters](https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline) (medium, CVSS 6.1, published 7 Jul 2026) - [CVE-2026-53877: Django GDALRaster heap buffer over-read in GIS component](https://junglewise.ai/threats/cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component) (medium, CVSS 4.8, published 7 Jul 2026) - [CVE-2026-48588: Django private data exposure in UpdateCacheMiddleware caching](https://junglewise.ai/threats/cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-45231: PYSEC-2026-1297 - Django allows enumeration of user e-mail addresses](https://junglewise.ai/threats/cve-2024-45231-django-allows-enumeration-of-user-e-mail-addresses) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2013-1664: PYSEC-2026-801 - XML Entity Expansion (XEE) in Django](https://junglewise.ai/threats/cve-2013-1664-xml-entity-expansion-xee-in-django) (info, published 6 Jul 2026) - [CVE-2013-1665: PYSEC-2026-802 - XML External Entity (XXE) in Django](https://junglewise.ai/threats/cve-2013-1665-xml-external-entity-xxe-in-django) (info, published 6 Jul 2026) - [CVE-2007-0404: PYSEC-2026-630 - Django Arbitrary Code Execution](https://junglewise.ai/threats/cve-2007-0404-django-arbitrary-code-execution) (info, published 2 Jul 2026) - [CVE-2007-0405: PYSEC-2026-629 - Django Improper Access Control](https://junglewise.ai/threats/cve-2007-0405-django-improper-access-control) (info, published 2 Jul 2026) - [CVE-2026-8404: Django UpdateCacheMiddleware information disclosure via case-sensitive headers](https://junglewise.ai/threats/cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case) (low, CVSS 3.1, published 3 Jun 2026) - [CVE-2026-7666: Django cleartext email transmission in SMTP EmailBackend](https://junglewise.ai/threats/cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend) (medium, CVSS 4, published 3 Jun 2026) - [CVE-2026-6873: Django salt namespace collision in get_signed_cookie](https://junglewise.ai/threats/cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie) (low, CVSS 3.1, published 3 Jun 2026) - [CVE-2026-48587: Django information disclosure via whitespace padding in Vary header](https://junglewise.ai/threats/cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary) (low, CVSS 3.1, published 3 Jun 2026) - [CVE-2026-35193: Django UpdateCacheMiddleware information disclosure via missing Vary header](https://junglewise.ai/threats/cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing) (medium, CVSS 4, published 3 Jun 2026) - [CVE-2026-6907: Django incorrect caching of sensitive information in UpdateCacheMiddleware](https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in) (medium, CVSS 4.3, published 5 May 2026) - [CVE-2026-5766: Django Improper Handling of Length Parameter Inconsistency in ASGI requests](https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi) (medium, CVSS 5.3, published 5 May 2026) - [CVE-2026-35192: Django session leakage via public cached pages](https://junglewise.ai/threats/cve-2026-35192-django-session-leakage-via-public-cached-pages) (medium, CVSS 6.5, published 5 May 2026) - [CVE-2026-4292: Django privilege abuse in ModelAdmin.list_editable](https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable) (low, CVSS 3.1, published 7 Apr 2026) - [CVE-2026-4277: Django missing authorization in GenericInlineModelAdmin](https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin) (critical, CVSS 9.8, published 7 Apr 2026) - [CVE-2026-3902: Django ASGI header spoofing via underscore/hyphen conflation](https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation) (high, CVSS 7.5, published 7 Apr 2026) - [CVE-2026-33034: Django memory limit bypass in ASGI requests](https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests) (high, CVSS 7.5, published 7 Apr 2026) ## Most severe Django (PyPI) vulnerabilities - [CVE-2026-4277: Django missing authorization in GenericInlineModelAdmin](https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin) (critical, CVSS 9.8, published 7 Apr 2026) - [CVE-2025-64459: Django SQL injection in QuerySet and Q objects via _connector argument](https://junglewise.ai/threats/cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector) (critical, CVSS 9.1, published 5 Nov 2025) - [CVE-2020-9402: Django SQL injection in GIS functions for Oracle](https://junglewise.ai/threats/cve-2020-9402-django-sql-injection-in-gis-functions-for-oracle) (high, CVSS 8.8, published 5 Jun 2020) - [CVE-2026-15307: Django GeoDjango spatial lookups file write and request forgery](https://junglewise.ai/threats/cve-2026-15307-django-geodjango-spatial-lookups-file-write-and-request-forgery) (high, CVSS 8.8, published 4 Aug 2026) - [CVE-2010-4535: Django denial of service in password reset timestamp handling](https://junglewise.ai/threats/cve-2010-4535-django-denial-of-service-in-password-reset-timestamp-handling) (high, CVSS 7.5, published 23 Jul 2018) - [CVE-2025-64460: Django denial of service in XML serializer text extraction](https://junglewise.ai/threats/cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction) (high, CVSS 7.5, published 2 Dec 2025) - [CVE-2025-64458: Django denial of service in HttpResponseRedirect on Windows](https://junglewise.ai/threats/cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows) (high, CVSS 7.5, published 5 Nov 2025) - [CVE-2011-0696: Django CSRF protection bypass via X-Requested-With header](https://junglewise.ai/threats/cve-2011-0696-django-csrf-protection-bypass-via-x-requested-with-header) (high, CVSS 7.5, published 23 Jul 2018) - [CVE-2026-25673: Django denial of service in URLField via Unicode normalization on Windows](https://junglewise.ai/threats/cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on) (high, CVSS 7.5, published 3 Mar 2026) - [CVE-2026-33034: Django memory limit bypass in ASGI requests](https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests) (high, CVSS 7.5, published 7 Apr 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities - [exiv2 (PyPI)](https://junglewise.ai/threats/technologies/exiv2): 85 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Django (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/django, 13 November 2026.