Lucene search
+L

7678 matches found

CVE
CVE
added 2026/08/31 7:30 p.m.27 views

CVE-2026-82835

A vulnerability in caoqianming django-vue-admin 1.0 allows improper access control through manipulation of the file_id argument at the /api/file/ endpoint. The attack is executable remotely with low privileges and no user interaction . Exploit code has been made public and is rated as proof-of-co...

5.5CVSS5.8AI score0.00225EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/31 7:30 p.m.34 views

CVE-2026-82835 caoqianming django-vue-admin file access control

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...

5.5CVSS0.00225EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/31 7:30 p.m.9 views

EUVD-2026-68745

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...

5.5CVSS5.8AI score0.00225EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/31 9:49 a.m.8 views

CLSA-2026-1788169795 TuxCare security update for django (11 CVEs)

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.0.2.post6+tuxcare...

8.5CVSS6.9AI score0.12976EPSS
SaveExploits3
OSV
OSV
added 2026/08/31 9:04 a.m.9 views

CLSA-2026-1788167080 TuxCare security update for django (5 CVEs)

TuxCare rebuilt django to address 5 CVEs. Fixed in 4.2.post9+tuxcare...

7.5CVSS6.8AI score0.01032EPSS
SaveExploits0
OSV
OSV
added 2026/08/31 9:02 a.m.8 views

CLSA-2026-1788166978 TuxCare security update for django (6 CVEs)

TuxCare rebuilt django to address 6 CVEs. Fixed in 5.1.10.post3+tuxcare...

8.3CVSS6.9AI score0.01032EPSS
SaveExploits0
NVD
NVD
added 2026/08/25 5:17 p.m.11 views

CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

8.2CVSS0.00283EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/25 4:05 p.m.8 views

EUVD-2026-65600

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

8.2CVSS5.3AI score0.00283EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/25 4:05 p.m.9 views

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

8.2CVSS5.6AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.12 views

PT-2026-81390

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.4 Description An authentication bypass exists in the LiveViewConsumer when a view is restricted by login required, permission required, or a redirecting on mount hook. In these cases, the handle mount function sends...

8.2CVSS5.4AI score0.00283EPSS
SaveExploits0References13
NVD
NVD
added 2026/08/24 9:17 p.m.15 views

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

4.3CVSS0.002EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/24 8:09 p.m.15 views

EUVD-2026-63564

django CMS: Page cache ignores plugin-declared Vary headers disclosure & poisoning...

4.8CVSS5.1AI score0.00147EPSS
SaveExploits0References8
Github Security Blog
Github Security Blog
added 2026/08/24 8:09 p.m.8 views

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

4.8CVSS5.4AI score0.00147EPSS
SaveExploits0References9Affected Software1
OSV
OSV
added 2026/08/24 8:09 p.m.8 views

GHSA-FWJF-M4QW-9F2X django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

4.8CVSS5.6AI score0.00147EPSS
SaveExploits0References9
OSV
OSV
added 2026/08/24 8:09 p.m.6 views

GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

7.1CVSS6.2AI score0.00345EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/24 8:09 p.m.18 views

EUVD-2026-63565

django CMS: Plugin move endpoint allows cyclic reparenting DoS...

7.1CVSS5.1AI score0.00345EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/08/24 8:09 p.m.9 views

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

7.1CVSS5.9AI score0.00345EPSS
SaveExploits0References6Affected Software1
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.11 views

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

8.8CVSS6.5AI score0.00895EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux
added 2026/08/24 4:36 p.m.9 views

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

8.8CVSS6.5AI score0.00895EPSS
SaveExploits0References11
RedHat Linux
RedHat Linux
added 2026/08/24 4:31 p.m.11 views

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

8.8CVSS6.3AI score0.00895EPSS
SaveExploits0References11
Rows per page
Query Builder