Technology
Django vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 17 vulnerabilities in Django: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71461, was published on 23 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.
- Last 7 days
- 0
- Last 90 days
- 1
- Critical, all time
- 0
- Exploited in the wild
- 0
About Django
Python web framework for building applications with high-level abstractions and rapid development.
Latest Django vulnerabilities
- CVE-2026-71461: Django HostList.list() information disclosure via unhandled exceptionmediumCVSS 4.3EPSS 0.2%
- CVE-2026-15307: Django GeoDjango spatial lookups file write and request forgeryhighCVSS 8.8EPSS 1.1%
- CVE-2023-24580: Django multipart request parser resource exhaustionlowCVSS 3.1EPSS 62.6%
- CVE-2022-28346: PYSEC-2022-190 - An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4…lowCVSS 3.1EPSS 18.7%
- CVE-2020-9402: Django SQL injection in GIS functions for OraclehighCVSS 8.8EPSS 22.5%
- CVE-2020-13596: Django XSS in admin ForeignKeyRawIdWidgetlowCVSS 3.1EPSS 2.9%
- CVE-2019-11358: PYSEC-2026-628 - XSS in jQuery as used in Drupal, Backdrop CMS, and other productslowCVSS 3.1EPSS 87.2%
- CVE-2019-3498: Django improper input validation in 404 error handlerlowCVSS 3EPSS 3.4%
- CVE-2011-0697: Django cross-site scripting via file upload filenamemediumCVSS 6.1EPSS 2.6%
- CVE-2010-4534: Django information disclosure in administrative interface filteringmediumCVSS 6.5EPSS 2.5%
- CVE-2011-0696: Django CSRF protection bypass via X-Requested-With headerhighCVSS 7.5EPSS 1.6%
- CVE-2018-7537: Django denial-of-service in truncatechars_html and truncatewords_html filterslowCVSS 3EPSS 4.4%
- CVE-2017-7233: Django open redirect and XSS via numeric redirect URLslowCVSS 3EPSS 2.4%
- CVE-2016-9014: Django DNS rebinding vulnerability in Host header validationlowCVSS 3EPSS 6.1%
- CVE-2014-0481: Django denial of service via file upload naminglowCVSS 3.1EPSS 2.5%
- CVE-2012-4520: Django arbitrary URL generation in get_hostlowCVSS 3.1EPSS 3.7%
- CVE-2011-4137: Django URLField denial of service via uncontrolled URL accesslowCVSS 3.1EPSS 3.0%
Most severe Django vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-9402: Django SQL injection in GIS functions for OraclehighCVSS 8.8EPSS 22.5%
- CVE-2026-15307: Django GeoDjango spatial lookups file write and request forgeryhighCVSS 8.8EPSS 1.1%
- CVE-2011-0696: Django CSRF protection bypass via X-Requested-With headerhighCVSS 7.5EPSS 1.6%
- CVE-2010-4534: Django information disclosure in administrative interface filteringmediumCVSS 6.5EPSS 2.5%
- CVE-2011-0697: Django cross-site scripting via file upload filenamemediumCVSS 6.1EPSS 2.6%
- CVE-2026-71461: Django HostList.list() information disclosure via unhandled exceptionmediumCVSS 4.3EPSS 0.2%
- CVE-2019-11358: PYSEC-2026-628 - XSS in jQuery as used in Drupal, Backdrop CMS, and other productslowCVSS 3.1EPSS 87.2%
- CVE-2023-24580: Django multipart request parser resource exhaustionlowCVSS 3.1EPSS 62.6%
- CVE-2022-28346: PYSEC-2022-190 - An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4…lowCVSS 3.1EPSS 18.7%
- CVE-2012-4520: Django arbitrary URL generation in get_hostlowCVSS 3.1EPSS 3.7%
Vulnerabilities per week
Nothing in the last four weeks, down from 1 vulnerability in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Django vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/x-django)<a href="https://junglewise.ai/threats/technologies/x-django"><img src="https://junglewise.ai/threats/technologies/x-django/badge.svg" alt="Django vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/x-django.json, and this page as text at https://junglewise.ai/threats/technologies/x-django.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Django vulnerabilities", https://junglewise.ai/threats/technologies/x-django, 9 November 2026.