USN-8154-1 python-django vulnerabilities

Seokchan Yoon discovered that Django incorrectly handled copying memory when parsing multipart uploads with excessive whitespace. A remote attacker could possibly use this issue to cause Django to use excessive resources, leading to a denial of service. CVE-2026-33033 It was discovered that Djang...

CVE-2026-35486

creationtimestamp| type| source ---|---|--- 2026-04-07 17:29:14+00:00| published-proof-of-concept| Telegram/8eXn4QLj3W18AYc2pIsiDgfSWsuolTpz1YwE008yOgTXtw 2026-04-10 00:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj43emha3t2c...

CVE-2026-5731

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-08 12:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6aeqsg2z 2026-04-09 00:01:20+00:00| seen|...

CVE-2026-35554

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-16 11:30:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjmco46nbc2h...

CVE-2026-5732

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-08 12:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6aeqsg2z 2026-04-09 00:01:18+00:00| seen|...

CVE-2026-35567

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39327. Reason: This candidate is a duplicate of CVE-2026-39327. Notes: All CVE users should reference CVE-2026-39327 instead of this candidate. All references and descriptions in this candidate have been removed to...

Missing Authorization

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Missing Authorization in the InlineModelAdmin.getformset function. An attacker can gain unauthorized access to add inline model...

Missing Authorization

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Missing Authorization in the admin changelist forms using ModelAdmin.listeditable. An attacker can gain unauthorized access to...

CVE-2026-3902

creationtimestamp| type| source ---|---|--- 2026-04-07 16:06:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw5w2nhm324 2026-04-07 19:33:24+00:00| seen| Telegram/UR5TCX5vufcj9skQtsOGmPNpHO32u3eWlC-vhPXaaDs7Lc...

CVE-2026-35567

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39327. Reason: This candidate is a duplicate of CVE-2026-39327. Notes: All CVE users should reference CVE-2026-39327 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2026-40180

creationtimestamp| type| source ---|---|--- 2026-04-07 15:39:13+00:00| published-proof-of-concept| https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-jx2w-vp7f-456q 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-10...

CVE-2026-39865

creationtimestamp| type| source ---|---|--- 2026-04-07 15:38:21+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8 2026-04-08 18:06:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyv426cdt2g...

EUVD-2026-19687

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

GHSA-MMWR-2JHP-MC7J Django vulnerable to privilege abuse in ModelAdmin.list_editable

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

GHSA-PWJP-CCJC-GHWG Django vulnerable to privilege abuse in GenericInlineModelAdmin

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

Django vulnerable to privilege abuse in ModelAdmin.list_editable

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

EUVD-2026-19688

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changelist forms using ModelAdmin.listeditable incorrectly allowed new instances to be created via forged POST data. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

Django vulnerable to privilege abuse in GenericInlineModelAdmin

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submission of forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not evaluated a...

CVE-2026-35457

creationtimestamp| type| source ---|---|--- 2026-04-07 15:28:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miw3rw4xzh27 2026-04-07 17:29:08+00:00| seen| Telegram/S0o7tCbZtDmnRvZjM5kXvvB9yXwoblxnXV5GlrmaLffoEZI 2026-04-27 04:07:08+00:00| seen|...

CVE-2026-23818

creationtimestamp| type| source ---|---|--- 2026-04-07 15:21:06+00:00| published-proof-of-concept| Telegram/QBh1FHyWJUCKYAyST3Bw6jIrLbUdJEHanO8DcWQylla0 2026-04-07 15:24:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw3lgfeo522 2026-04-08 12:10:30+00:00| seen|...