{"schema_version":1,"title":"Djangoproject Django vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in Djangoproject Django: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-6907, was published on 5 May 2026.","url":"https://junglewise.ai/threats/technologies/djangoproject-django","json_url":"https://junglewise.ai/threats/technologies/djangoproject-django.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/djangoproject-django","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":10,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":10},"latest":[{"cve":"CVE-2026-6907","cvss":4.3,"epss":0.0036,"slug":"cve-2026-6907-django-incorrect-caching-of-sensitive-information-in","title":"Django incorrect caching of sensitive information in UpdateCacheMiddleware","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:18.227+00:00","url":"https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in"},{"cve":"CVE-2026-5766","cvss":5.3,"epss":0.0042,"slug":"cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi","title":"Django Improper Handling of Length Parameter Inconsistency in ASGI requests","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:17.74+00:00","url":"https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi"},{"cve":"CVE-2026-35192","cvss":6.5,"epss":0.0054,"slug":"cve-2026-35192-django-session-leakage-via-public-cached-pages","title":"Django session leakage via public cached pages","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:12.383+00:00","url":"https://junglewise.ai/threats/cve-2026-35192-django-session-leakage-via-public-cached-pages"},{"cve":"CVE-2026-4292","cvss":3.1,"epss":0.0029,"slug":"cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable","title":"Django privilege abuse in ModelAdmin.list_editable","severity":"low","exploited":false,"published_at":"2026-04-07T15:17:46.65+00:00","url":"https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable"},{"cve":"CVE-2026-4277","cvss":9.8,"epss":0.0046,"slug":"cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin","title":"Django missing authorization in GenericInlineModelAdmin","severity":"critical","exploited":false,"published_at":"2026-04-07T15:17:46.5+00:00","url":"https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0044,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:46.353+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0077,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:39.393+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-33033","cvss":6.5,"epss":0.0088,"slug":"cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads","title":"Django DoS in MultiPartParser via crafted multipart uploads","severity":"medium","exploited":false,"published_at":"2026-04-07T15:17:39.22+00:00","url":"https://junglewise.ai/threats/cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads"},{"cve":"CVE-2025-64460","cvss":7.5,"epss":0.0209,"slug":"cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction","title":"Django denial of service in XML serializer text extraction","severity":"high","exploited":false,"published_at":"2025-12-02T16:15:56.013+00:00","url":"https://junglewise.ai/threats/cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction"},{"cve":"CVE-2025-13372","cvss":4.3,"epss":0.0092,"slug":"cve-2025-13372-django-sql-injection-in-filteredrelation-column-aliases-on","title":"Django SQL injection in FilteredRelation column aliases on PostgreSQL","severity":"medium","exploited":false,"published_at":"2025-12-02T16:15:53.907+00:00","url":"https://junglewise.ai/threats/cve-2025-13372-django-sql-injection-in-filteredrelation-column-aliases-on"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Djangoproject Django","slug":"djangoproject-django","vendor":{"hub":true,"name":"Djangoproject","slug":"djangoproject","url":"https://junglewise.ai/threats/vendors/djangoproject"},"aliases":[],"homepage":"https://www.djangoproject.com","description":"Python web framework for building applications with model-view-template architecture.","url":"https://junglewise.ai/threats/technologies/djangoproject-django"},"most_severe":[{"cve":"CVE-2026-4277","cvss":9.8,"epss":0.0046,"slug":"cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin","title":"Django missing authorization in GenericInlineModelAdmin","severity":"critical","exploited":false,"published_at":"2026-04-07T15:17:46.5+00:00","url":"https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin"},{"cve":"CVE-2025-64460","cvss":7.5,"epss":0.0209,"slug":"cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction","title":"Django denial of service in XML serializer text extraction","severity":"high","exploited":false,"published_at":"2025-12-02T16:15:56.013+00:00","url":"https://junglewise.ai/threats/cve-2025-64460-django-denial-of-service-in-xml-serializer-text-extraction"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0077,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:39.393+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0044,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:17:46.353+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2026-33033","cvss":6.5,"epss":0.0088,"slug":"cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads","title":"Django DoS in MultiPartParser via crafted multipart uploads","severity":"medium","exploited":false,"published_at":"2026-04-07T15:17:39.22+00:00","url":"https://junglewise.ai/threats/cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads"},{"cve":"CVE-2026-35192","cvss":6.5,"epss":0.0054,"slug":"cve-2026-35192-django-session-leakage-via-public-cached-pages","title":"Django session leakage via public cached pages","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:12.383+00:00","url":"https://junglewise.ai/threats/cve-2026-35192-django-session-leakage-via-public-cached-pages"},{"cve":"CVE-2026-5766","cvss":5.3,"epss":0.0042,"slug":"cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi","title":"Django Improper Handling of Length Parameter Inconsistency in ASGI requests","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:17.74+00:00","url":"https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi"},{"cve":"CVE-2025-13372","cvss":4.3,"epss":0.0092,"slug":"cve-2025-13372-django-sql-injection-in-filteredrelation-column-aliases-on","title":"Django SQL injection in FilteredRelation column aliases on PostgreSQL","severity":"medium","exploited":false,"published_at":"2025-12-02T16:15:53.907+00:00","url":"https://junglewise.ai/threats/cve-2025-13372-django-sql-injection-in-filteredrelation-column-aliases-on"},{"cve":"CVE-2026-6907","cvss":4.3,"epss":0.0036,"slug":"cve-2026-6907-django-incorrect-caching-of-sensitive-information-in","title":"Django incorrect caching of sensitive information in UpdateCacheMiddleware","severity":"medium","exploited":false,"published_at":"2026-05-05T16:16:18.227+00:00","url":"https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in"},{"cve":"CVE-2026-4292","cvss":3.1,"epss":0.0029,"slug":"cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable","title":"Django privilege abuse in ModelAdmin.list_editable","severity":"low","exploited":false,"published_at":"2026-04-07T15:17:46.65+00:00","url":"https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}