RedTeamBrasil-CVE-2025-64459

connector-sqli Automated SQL Injection exploitation in Django's ORM Q-object connector · CVE-2025-64459 🎥 RedTeam Brasil channel — offensive security, hands-on, in Portuguese. root@kitploit: ██████╗ ████████╗██████╗ connector-sqli ██╔══██╗╚══██╔══╝██╔══██╗ Django Q connector SQLi ██████╔╝ ██║...

CLSA-2026-1788438779 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post17+tuxcare...

CLSA-2026-1788438777 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.2.post7+tuxcare...

CLSA-2026-1788437939 TuxCare security update for django (5 CVEs)

TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.post10+tuxcare...

CLSA-2026-1788437106 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post5+tuxcare...

CLSA-2026-1788437086 TuxCare security update for django (3 CVEs)

TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.4.post5+tuxcare...

CLSA-2026-1788344280 TuxCare security update for django (3 CVEs)

TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.9.post4+tuxcare...

CLSA-2026-1788335220 TuxCare security update for django (5 CVEs)

TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post7+tuxcare...

GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

EUVD-2026-56887

Django REST framework: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data...

EUVD-2026-56888

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests...

GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

CVE-2026-16206

A flaw was found in django-oauth-toolkit. A remote attacker can exploit a vulnerability in the loadidtoken function to manipulate session handling, leading to session expiration. This can result in a denial of service for affected users by prematurely ending their active sessions...

ROOT-APP-PYPI-CVE-2025-64458 CVE-2025-64458 in django - Patched by Root

Root has patched CVE-2025-64458 in the django package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-48432 CVE-2025-48432 in django - Patched by Root

Root has patched CVE-2025-48432 in the django package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-45231 CVE-2024-45231 in django - Patched by Root

Root has patched CVE-2024-45231 in the django package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-36359 CVE-2022-36359 in django - Patched by Root

Root has patched CVE-2022-36359 in the django package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-64459 CVE-2025-64459 in django - Patched by Root

Root has patched CVE-2025-64459 in the django package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-57833 CVE-2025-57833 in django - Patched by Root

Root has patched CVE-2025-57833 in the django package for Root:PyPI. Multiple fixed versions available...

CVE-2026-82835

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...