djangocms-link (>=1.8.0, <=1.8.3) potentially affected by CVE-2025-48383 via django-select2 (4.3.2)

django-select2 PYPI version 4.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - djangocms-link =1.8.0, =1.8.3 Source cves: CVE-2025-48383 Source advisory: OSV:PYSEC-2026-1300...

django-multitenancy-manager (>=0.0.2a0, <=0.0.2a27), django-tenants-manager (0.0.1) +1 more potentially affected by CVE-2025-48383 via django-select2 (7.10.1)

django-select2 PYPI version 7.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - django-multitenancy-manager =0.0.2a0, =0.0.2a27 - django-tenants-manager 0.0.1 - geonode 4.0.1 Source cves: CVE-2025-48383 Source...

byro (>=2023.1.0, <=2026.1.2), django-ndr-core (>=0.8.0, <=0.42.0) +12 more potentially affected by CVE-2025-48383 via django-select2 (>=8.0.0, <=8.2.4)

django-select2 PYPI version =8.0.0, =2023.1.0, =0.8.0, =2.2.0, =0.9.0, =4.0.2, =0.1.4.12, =0.1.2.5, =1.0.3, =0.12.1, =0.9.0, =0.12.0 Source cves: CVE-2025-48383 Source advisory: OSV:PYSEC-2026-1300...

m3-django-fias (>=1.2.6, <=2.0.1) potentially affected by CVE-2025-48383 via django-select2 (5.11.1)

django-select2 PYPI version 5.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - m3-django-fias =1.2.6, =2.0.1 Source cves: CVE-2025-48383 Source advisory: OSV:PYSEC-2026-1300...

nobinobi-child (0.1.0) potentially affected by CVE-2025-48383 via django-select2 (7.4.2)

django-select2 PYPI version 7.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - nobinobi-child 0.1.0 Source cves: CVE-2025-48383 Source advisory: OSV:PYSEC-2026-1300...

aleksis (>=1.0.0a4.dev0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +19 more potentially affected by CVE-2025-48383 via django-select2 (7.11.1)

django-select2 PYPI version 7.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - aleksis =1.0.0a4.dev0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 and...

tpl-accounting (>=1.1.0, <=1.3.0) potentially affected by CVE-2025-48383 via django-select2 (7.0.2)

django-select2 PYPI version 7.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - tpl-accounting =1.1.0, =1.3.0 Source cves: CVE-2025-48383 Source advisory: OSV:PYSEC-2026-1300...

Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

ImpactInstances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can secret access tokens across requests. This can allow users to access restricted querysets and restricted data. PatchesThe problem has been patched in version 8.4.1 and all following...

django-shop (1.2.4), djangoshop-gestpay (0.1.0) +4 more potentially affected by CVE-2025-48383 via django-select2 (7.10.0)

django-select2 PYPI version 7.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - django-shop 1.2.4 - djangoshop-gestpay 0.1.0 - djangoshop-wspay 0.1.0 - geonode =4.0.0, =0.10.0, =0.4.0, =0.8.0 Source cves:...

aldryn-django-cms (3.5.3.2), django-fias (1.2.2) +1 more potentially affected by CVE-2025-48383 via django-select2 (6.3.1)

django-select2 PYPI version 6.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - aldryn-django-cms 3.5.3.2 - django-fias 1.2.2 - stem-registration =0.0.27, =0.0.49 Source cves: CVE-2025-48383 Source advisory:...

EUVD-2025-28218

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-48383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and...

Information Leakage

djangoselect2 is vulnerable to information leakage. The vulnerability is due to improper handling of instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget, allowing an attacker to access restricted query sets and sensitive data...

m3-django-fias (>=1.2.6, <=2.0.1) potentially affected by CVE-2025-48383 via django-select2 (5.11.1)

django-select2 PYPI version 5.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - m3-django-fias =1.2.6, =2.0.1 Source cves: CVE-2025-48383 Source advisory: OSV:GHSA-WJRH-HJ83-3WH7...

aleksis (>=1.0.0a4.dev0, <=2023.1.0.dev0), aleksis-app-alsijil (>=2.0.0, <=2.1.1) +19 more potentially affected by CVE-2025-48383 via django-select2 (7.11.1)

django-select2 PYPI version 7.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - aleksis =1.0.0a4.dev0, =2.0.0, =1.0.0, =2.0.0, =2.1.0, =2.0.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =0.1.1, =2.0.0b0, =1.0.0, =1.0.2 and...

byro (2023.1.0), django-ndr-core (>=0.8.0, <=0.42.0) +4 more potentially affected by CVE-2025-48383 via django-select2 (>=8.0.0, <=8.2.1)

django-select2 PYPI version =8.0.0, =0.8.0, =4.0.2, =0.1.4.12, =0.1.2.5, =0.1.2.15 - nobinobi-kitchen 0.1.1 Source cves: CVE-2025-48383 Source advisory: SNYK:PYTHON-DJANGOSELECT2-10255155...

GHSA-WJRH-HJ83-3WH7 Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

Impact Instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can secret access tokens across requests. This can allow users to access restricted querysets and restricted data. Patches The problem has been patched in version 8.4.1 and all following...

Transmission of Private Resources into a New Sphere ('Resource Leak')

Overview django-select2 is a Django integration of Select2. Affected versions of this package are vulnerable to Transmission of Private Resources into a New Sphere 'Resource Leak' via a HeavySelect2Mixin class in forms.py. An attacker can access restricted data by exploiting the reuse of widget...

aldryn-django-cms (3.5.3.2), django-fias (1.2.2) +1 more potentially affected by CVE-2025-48383 via django-select2 (6.3.1)

django-select2 PYPI version 6.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-select2 and may be impacted: - aldryn-django-cms 3.5.3.2 - django-fias 1.2.2 - stem-registration =0.0.27, =0.0.49 Source cves: CVE-2025-48383 Source advisory:...

byro (>=2023.1.0, <=2026.1.2), django-ndr-core (>=0.8.0, <=0.42.0) +12 more potentially affected by CVE-2025-48383 via django-select2 (>=8.0.0, <=8.2.4)

django-select2 PYPI version =8.0.0, =2023.1.0, =0.8.0, =2.2.0, =0.9.0, =4.0.2, =0.1.4.12, =0.1.2.5, =1.0.3, =0.12.1, =0.9.0, =0.12.0 Source cves: CVE-2025-48383 Source advisory: OSV:GHSA-WJRH-HJ83-3WH7...