DJ
Product
Django
161
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 46Medium 51Low 5
Watch
Add Django to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-12781 | 5.3 | Jul 1 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3 Affected: 1.11 before 1.11.22; 2.1 before 2.1.10; 2.2 before 2.2.3 |
| CVE-2018-7537 | 5.3 | Mar 9 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 Affected: 1.8 before 1.8.19; 1.11 before 1.11.11; 2.0 before 2.0.3 |
| CVE-2018-7536 | 5.3 | Mar 9 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19 Affected: 1.8 before 1.8.19; 1.11 before 1.11.11; 2.0 before 2.0.3 |
| CVE-2021-33203 | 4.9 | Jun 8 | Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs Affected: before 2.2.24; 3.0.0 before 3.1.12; 3.2.0 before 3.2.4 |
| CVE-2018-16984 | 4.9 | Oct 2 | An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts Affected: 2.1 before 2.1.2 |
| CVE-2026-53877 | 4.8 | Jul 7 | Heap buffer over-read in GDALRaster Affected: 6.0 before 6.0.7; 5.2 before 5.2.16 |
| CVE-2026-87975 | 4.3 | Oct 6 | Privilege abuse in model formsets with editable primary keys Affected: 6.1 before 6.1.2; 6.0 before 6.0.9; 5.2 before 5.2.18 |
| CVE-2026-6873 | 4.3 | Jun 3 | Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie Affected: 6.0 before 6.0.6; 5.2 before 5.2.15 |
| CVE-2025-13372 | 4.3 | Dec 2 | Potential SQL injection in FilteredRelation column aliases on PostgreSQL Affected: 5.2 before 5.2.9; 5.1 before 5.1.15; 4.2 before 4.2.27 |
| CVE-2024-39330 | 4.3 | Jul 10 | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14 Affected: 4.2 before 4.2.14; 5.0 before 5.0.7 |
| CVE-2026-25674 | 3.7 | Mar 3 | Potential incorrect permissions on newly created file system objects Affected: 6.0 before 6.0.3; 5.2 before 5.2.12; 4.2 before 4.2.29 |
| CVE-2026-35193 | 3.1 | Jun 3 | Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware Affected: 6.0 before 6.0.6; 5.2 before 5.2.15 |
| CVE-2026-7666 | 3.1 | Jun 3 | Potential unencrypted email transmission via STARTTLS in the SMTP backend Affected: 6.0 before 6.0.6; 5.2 before 5.2.15 |
| CVE-2016-2513 | 3.1 | Apr 8 | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login… Affected: 1.8.9; 1.9; 1.9.1; 1.9.2 |
| CVE-2026-4292 | 2.7 | Apr 7 | Privilege abuse in ModelAdmin.list_editable Affected: 6.0 before 6.0.4; 5.2 before 5.2.13; 4.2 before 4.2.30 |
| CVE-2015-8213 | – | Dec 7 | The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive… Affected: through 1.7.10; 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; +3 more |
| CVE-2015-5964 | – | Aug 24 | The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other… Affected: 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; 1.4.6; +33 more |
| CVE-2015-5963 | – | Aug 24 | contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause… Affected: 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; 1.4.6; +33 more |
| CVE-2015-5145 | – | Jul 14 | validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors Affected: 1.8.0; 1.8.1; 1.8.2 |
| CVE-2015-5144 | – | Jul 14 | Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary… Affected: through 1.4.20; 1.5; 1.5; 1.5; 1.5.1; 1.5.2; +34 more |
| CVE-2015-5143 | – | Jul 14 | The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store… Affected: 1.4.20; 1.5; 1.5; 1.5; 1.5.1; 1.5.2; +34 more |
| CVE-2015-3982 | – | Jun 2 | The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an… Affected: 1.8.0; 1.8.1 |
| CVE-2015-2317 | – | Mar 25 | The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows… Affected: through 1.4.19; 1.5; 1.5; 1.5; 1.5.1; 1.5.2; +34 more |
| CVE-2015-2316 | – | Mar 25 | The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6.1; +23 more |
| CVE-2015-2241 | – | Mar 12 | Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web… Affected: through 1.7.5; 1.8 |
| CVE-2015-0222 | – | Jan 16 | ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by… Affected: through 1.4.17; 1.6; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +8 more |
| CVE-2015-0221 | – | Jan 16 | The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to… Affected: through 1.4.17; 1.6; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +8 more |
| CVE-2015-0220 | – | Jan 16 | The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote… Affected: through 1.4.17; 1.6; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +8 more |
| CVE-2015-0219 | – | Jan 16 | Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash)… Affected: through 1.4.17; 1.6; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +8 more |
| CVE-2014-0483 | – | Aug 26 | The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field… Affected: 1.5; 1.5; 1.5; 1.5.1; 1.5.2; 1.5.3; +34 more |
| CVE-2014-0482 | – | Aug 26 | The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the… Affected: 1.6; 1.6; 1.6; 1.6; 1.6; 1.6.1; +34 more |
| CVE-2014-0481 | – | Aug 26 | The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential… Affected: through 1.4.13; 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; +34 more |
| CVE-2014-0480 | – | Aug 26 | The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which… Affected: 1.7; 1.7; 1.7; 1.7; 1.7; 1.7; +34 more |
| CVE-2014-3730 | – | May 16 | The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows… Affected: 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; 1.4.6; +28 more |
| CVE-2014-1418 | – | May 16 | Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which… Affected: 1.7; 1.7; 1.7; 1.4; 1.4.1; 1.4.2; +28 more |
| CVE-2014-0474 | – | Apr 23 | The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7… Affected: 1.6; 1.6.1; 1.6.2; through 1.4.10; 1.4; 1.4.1; +17 more |
| CVE-2014-0473 | – | Apr 23 | The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows… Affected: 1.5; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +17 more |
| CVE-2014-0472 | – | Apr 23 | The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and… Affected: through 1.4.10; 1.4; 1.4.1; 1.4.2; 1.4.3; 1.4.4; +17 more |
| CVE-2013-6044 | – | Oct 4 | The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS,… Affected: 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; 1.5; +2 more |
| CVE-2013-4249 | – | Oct 4 | Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote… Affected: 1.5; 1.5; 1.5; 1.5.1; 1.6 |
| CVE-2013-1443 | – | Sep 23 | The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of… Affected: 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; 1.4.6; +10 more |
| CVE-2013-4315 | – | Sep 16 | Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in… Affected: 1.4; 1.4.1; 1.4.2; 1.4.4; 1.4.5; 1.4.6; +6 more |
| CVE-2013-0306 | – | May 2 | The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and… Affected: 1.3; 1.3; 1.3; 1.3.1; 1.3.2; 1.3.3; +7 more |
| CVE-2013-0305 | – | May 2 | The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows… Affected: 1.3; 1.3; 1.3; 1.3.1; 1.3.2; 1.3.3; +7 more |
| CVE-2012-4520 | – | Nov 18 | The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted… Affected: 1.3; 1.3; 1.3; 1.3.1; 1.3.2; 1.3.3; +2 more |
| CVE-2012-3444 | – | Jul 31 | The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine… Affected: through 1.3; 0.95; 0.96; 1.0; 1.0; 1.0; +23 more |
| CVE-2012-3443 | – | Jul 31 | The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote… Affected: through 1.3; 0.95; 0.96; 1.0; 1.0; 1.0; +23 more |
| CVE-2012-3442 | – | Jul 31 | The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a… Affected: before 1.3.2; 1.4 |
| CVE-2011-4140 | – | Oct 19 | The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which… Affected: through 1.2.6; 0.91; 0.95; 0.95.1; 0.96; 1.0; +16 more |
| CVE-2011-4139 | – | Oct 19 | Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache… Affected: through 1.2.6; 0.91; 0.95; 0.95.1; 0.96; 1.0; +16 more |