{"schema_version":1,"title":"Django vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 46 vulnerabilities in Django: 1 in the last 7 days and 5 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71461, was published on 23 September 2026.","url":"https://junglewise.ai/threats/technologies/x-django","json_url":"https://junglewise.ai/threats/technologies/x-django.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/x-django","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":10,"all_time":46,"critical":1,"exploited":0,"last_7_days":1,"last_30_days":1,"last_90_days":5,"last_365_days":30},"latest":[{"cve":"CVE-2026-71461","cvss":4.3,"epss":0.0021,"slug":"cve-2026-71461-hostlist-list-catches-bare-exception-and-returns-str-e-verbatim","title":"Django HostList.list() information disclosure via unhandled exception","severity":"medium","exploited":false,"published_at":"2026-09-23T19:19:02.953+00:00","url":"https://junglewise.ai/threats/cve-2026-71461-hostlist-list-catches-bare-exception-and-returns-str-e-verbatim"},{"cve":"CVE-2026-15830","cvss":5.3,"epss":0.0076,"slug":"cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service","title":"Django GeoDjango unbounded recursion denial of service","severity":"medium","exploited":false,"published_at":"2026-08-04T17:16:46.593+00:00","url":"https://junglewise.ai/threats/cve-2026-15830-django-geodjango-unbounded-recursion-denial-of-service"},{"cve":"CVE-2026-53878","cvss":6.1,"epss":0.0033,"slug":"cve-2026-53878-django-domainnamevalidator-header-injection-via-newline","title":"Django DomainNameValidator header injection via newline characters","severity":"medium","exploited":false,"published_at":"2026-07-07T15:16:48.583+00:00","url":"https://junglewise.ai/threats/cve-2026-53878-django-domainnamevalidator-header-injection-via-newline"},{"cve":"CVE-2026-53877","cvss":4.8,"epss":0.0044,"slug":"cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component","title":"Django GDALRaster heap buffer over-read in GIS component","severity":"medium","exploited":false,"published_at":"2026-07-07T15:16:48.453+00:00","url":"https://junglewise.ai/threats/cve-2026-53877-django-gdalraster-heap-buffer-over-read-in-gis-component"},{"cve":"CVE-2026-48588","cvss":3.1,"epss":0.0043,"slug":"cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching","title":"Django private data exposure in UpdateCacheMiddleware caching","severity":"low","exploited":false,"published_at":"2026-07-07T15:16:47.447+00:00","url":"https://junglewise.ai/threats/cve-2026-48588-django-private-data-exposure-in-updatecachemiddleware-caching"},{"cve":"CVE-2026-8404","cvss":3.1,"epss":0.0043,"slug":"cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case","title":"Django UpdateCacheMiddleware information disclosure via case-sensitive headers","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:47.65+00:00","url":"https://junglewise.ai/threats/cve-2026-8404-django-updatecachemiddleware-information-disclosure-via-case"},{"cve":"CVE-2026-7666","cvss":4,"epss":0.0021,"slug":"cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend","title":"Django cleartext email transmission in SMTP EmailBackend","severity":"medium","exploited":false,"published_at":"2026-06-03T14:16:47.087+00:00","url":"https://junglewise.ai/threats/cve-2026-7666-django-cleartext-email-transmission-in-smtp-emailbackend"},{"cve":"CVE-2026-6873","cvss":3.1,"epss":0.0028,"slug":"cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie","title":"Django salt namespace collision in get_signed_cookie","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:46.483+00:00","url":"https://junglewise.ai/threats/cve-2026-6873-django-salt-namespace-collision-in-get-signed-cookie"},{"cve":"CVE-2026-48587","cvss":3.1,"epss":0.0043,"slug":"cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary","title":"Django information disclosure via whitespace padding in Vary header","severity":"low","exploited":false,"published_at":"2026-06-03T14:16:44.983+00:00","url":"https://junglewise.ai/threats/cve-2026-48587-django-information-disclosure-via-whitespace-padding-in-vary"},{"cve":"CVE-2026-35193","cvss":4,"epss":0.0043,"slug":"cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing","title":"Django UpdateCacheMiddleware information disclosure via missing Vary header","severity":"medium","exploited":false,"published_at":"2026-06-03T14:16:41.247+00:00","url":"https://junglewise.ai/threats/cve-2026-35193-django-updatecachemiddleware-information-disclosure-via-missing"},{"cve":"CVE-2026-6907","cvss":4.3,"epss":0.0044,"slug":"cve-2026-6907-django-incorrect-caching-of-sensitive-information-in","title":"Django incorrect caching of sensitive information in UpdateCacheMiddleware","severity":"medium","exploited":false,"published_at":"2026-05-05T18:33:26+00:00","url":"https://junglewise.ai/threats/cve-2026-6907-django-incorrect-caching-of-sensitive-information-in"},{"cve":"CVE-2026-5766","cvss":5.3,"epss":0.0052,"slug":"cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi","title":"Django Improper Handling of Length Parameter Inconsistency in ASGI requests","severity":"medium","exploited":false,"published_at":"2026-05-05T18:33:26+00:00","url":"https://junglewise.ai/threats/cve-2026-5766-django-improper-handling-of-length-parameter-inconsistency-in-asgi"},{"cve":"CVE-2026-35192","cvss":4,"epss":0.0069,"slug":"cve-2026-35192-django-session-leakage-via-public-cached-pages","title":"Django session leakage via public cached pages","severity":"medium","exploited":false,"published_at":"2026-05-05T18:33:24+00:00","url":"https://junglewise.ai/threats/cve-2026-35192-django-session-leakage-via-public-cached-pages"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0055,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2026-4277","cvss":4,"epss":0.006,"slug":"cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin","title":"Django missing authorization in GenericInlineModelAdmin","severity":"medium","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-4277-django-missing-authorization-in-genericinlinemodeladmin"},{"cve":"CVE-2026-4292","cvss":3.1,"epss":0.0036,"slug":"cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable","title":"Django privilege abuse in ModelAdmin.list_editable","severity":"low","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-4292-django-privilege-abuse-in-modeladmin-list-editable"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0085,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:51+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-33033","cvss":6.5,"epss":0.0088,"slug":"cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads","title":"Django DoS in MultiPartParser via crafted multipart uploads","severity":"medium","exploited":false,"published_at":"2026-04-07T15:30:51+00:00","url":"https://junglewise.ai/threats/cve-2026-33033-django-dos-in-multipartparser-via-crafted-multipart-uploads"},{"cve":"CVE-2026-25673","cvss":7.5,"epss":0.011,"slug":"cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on","title":"Django denial of service in URLField via Unicode normalization on Windows","severity":"high","exploited":false,"published_at":"2026-03-03T15:16:19.103+00:00","url":"https://junglewise.ai/threats/cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on"},{"cve":"CVE-2025-14550","cvss":4,"epss":0.0106,"slug":"cve-2025-14550-django-dos-via-inefficient-algorithmic-complexity-in-asgirequest","title":"Django DoS via inefficient algorithmic complexity in ASGIRequest","severity":"medium","exploited":false,"published_at":"2026-02-03T15:30:23+00:00","url":"https://junglewise.ai/threats/cve-2025-14550-django-dos-via-inefficient-algorithmic-complexity-in-asgirequest"},{"cve":"CVE-2025-13473","cvss":4,"epss":0.0076,"slug":"cve-2025-13473-django-user-enumeration-via-timing-attack-in-mod-wsgi-handler","title":"Django user enumeration via timing attack in mod_wsgi handler","severity":"medium","exploited":false,"published_at":"2026-02-03T15:30:23+00:00","url":"https://junglewise.ai/threats/cve-2025-13473-django-user-enumeration-via-timing-attack-in-mod-wsgi-handler"},{"cve":"CVE-2026-1285","cvss":4,"epss":0.0106,"slug":"cve-2026-1285-django-denial-of-service-in-truncator-html-methods","title":"Django denial of service in Truncator HTML methods","severity":"medium","exploited":false,"published_at":"2026-02-03T15:30:23+00:00","url":"https://junglewise.ai/threats/cve-2026-1285-django-denial-of-service-in-truncator-html-methods"},{"cve":"CVE-2026-1312","cvss":5.4,"epss":0.0085,"slug":"cve-2026-1312-django-sql-injection-in-queryset-order-by-and-filteredrelation","title":"Django SQL injection in QuerySet.order_by and FilteredRelation","severity":"medium","exploited":false,"published_at":"2026-02-03T15:16:13.833+00:00","url":"https://junglewise.ai/threats/cve-2026-1312-django-sql-injection-in-queryset-order-by-and-filteredrelation"},{"cve":"CVE-2026-1287","cvss":5.4,"epss":0.008,"slug":"cve-2026-1287-django-sql-injection-in-filteredrelation-column-aliases","title":"Django SQL injection in FilteredRelation column aliases","severity":"high","exploited":false,"published_at":"2026-02-03T15:16:13.703+00:00","url":"https://junglewise.ai/threats/cve-2026-1287-django-sql-injection-in-filteredrelation-column-aliases"},{"cve":"CVE-2026-1207","cvss":5.4,"epss":0.1325,"slug":"cve-2026-1207-django-sql-injection-in-rasterfield-lookups-on-postgis","title":"Django SQL injection in RasterField lookups on PostGIS","severity":"high","exploited":false,"published_at":"2026-02-03T15:16:13.433+00:00","url":"https://junglewise.ai/threats/cve-2026-1207-django-sql-injection-in-rasterfield-lookups-on-postgis"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Django","slug":"x-django","aliases":[],"category":"framework","description":"Python-based web application framework for building web applications.","url":"https://junglewise.ai/threats/technologies/x-django"},"most_severe":[{"cve":"CVE-2025-64459","cvss":9.1,"epss":0.194,"slug":"cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector","title":"Django SQL injection in QuerySet and Q objects via _connector argument","severity":"critical","exploited":false,"published_at":"2025-11-05T15:31:07+00:00","url":"https://junglewise.ai/threats/cve-2025-64459-django-sql-injection-in-queryset-and-q-objects-via-connector"},{"cve":"CVE-2020-9402","cvss":8.8,"epss":0.2251,"slug":"cve-2020-9402-django-sql-injection-in-gis-functions-for-oracle","title":"Django SQL injection in GIS functions for Oracle","severity":"high","exploited":false,"published_at":"2020-06-05T14:52:07+00:00","url":"https://junglewise.ai/threats/cve-2020-9402-django-sql-injection-in-gis-functions-for-oracle"},{"cve":"CVE-2025-64458","cvss":7.5,"epss":0.019,"slug":"cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows","title":"Django denial of service in HttpResponseRedirect on Windows","severity":"high","exploited":false,"published_at":"2025-11-05T15:31:07+00:00","url":"https://junglewise.ai/threats/cve-2025-64458-django-denial-of-service-in-httpresponseredirect-on-windows"},{"cve":"CVE-2011-0696","cvss":7.5,"epss":0.016,"slug":"cve-2011-0696-django-csrf-protection-bypass-via-x-requested-with-header","title":"Django CSRF protection bypass via X-Requested-With header","severity":"high","exploited":false,"published_at":"2018-07-23T19:51:10+00:00","url":"https://junglewise.ai/threats/cve-2011-0696-django-csrf-protection-bypass-via-x-requested-with-header"},{"cve":"CVE-2026-25673","cvss":7.5,"epss":0.011,"slug":"cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on","title":"Django denial of service in URLField via Unicode normalization on Windows","severity":"high","exploited":false,"published_at":"2026-03-03T15:16:19.103+00:00","url":"https://junglewise.ai/threats/cve-2026-25673-django-denial-of-service-in-urlfield-via-unicode-normalization-on"},{"cve":"CVE-2026-33034","cvss":7.5,"epss":0.0085,"slug":"cve-2026-33034-django-memory-limit-bypass-in-asgi-requests","title":"Django memory limit bypass in ASGI requests","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:51+00:00","url":"https://junglewise.ai/threats/cve-2026-33034-django-memory-limit-bypass-in-asgi-requests"},{"cve":"CVE-2026-3902","cvss":7.5,"epss":0.0055,"slug":"cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation","title":"Django ASGI header spoofing via underscore/hyphen conflation","severity":"high","exploited":false,"published_at":"2026-04-07T15:30:52+00:00","url":"https://junglewise.ai/threats/cve-2026-3902-django-asgi-header-spoofing-via-underscore-hyphen-conflation"},{"cve":"CVE-2025-57833","cvss":7.1,"epss":0.1676,"slug":"cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases","title":"Django SQL injection in FilteredRelation column aliases","severity":"high","exploited":false,"published_at":"2025-09-08T18:31:31+00:00","url":"https://junglewise.ai/threats/cve-2025-57833-django-sql-injection-in-filteredrelation-column-aliases"},{"cve":"CVE-2025-59681","cvss":7.1,"epss":0.0063,"slug":"cve-2025-59681-django-sql-injection-in-column-aliases-on-mysql-and-mariadb","title":"Django SQL injection in column aliases on MySQL and MariaDB","severity":"high","exploited":false,"published_at":"2025-10-01T21:31:21+00:00","url":"https://junglewise.ai/threats/cve-2025-59681-django-sql-injection-in-column-aliases-on-mysql-and-mariadb"},{"cve":"CVE-2026-1207","cvss":5.4,"epss":0.1325,"slug":"cve-2026-1207-django-sql-injection-in-rasterfield-lookups-on-postgis","title":"Django SQL injection in RasterField lookups on PostGIS","severity":"high","exploited":false,"published_at":"2026-02-03T15:16:13.433+00:00","url":"https://junglewise.ai/threats/cve-2026-1207-django-sql-injection-in-rasterfield-lookups-on-postgis"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}