django: Django SQL injection in FilteredRelation column aliases

An SQL injection flaw has been discovered in the Django web framework. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

django: Django SQL injection in FilteredRelation column aliases

An SQL injection flaw has been discovered in the Django web framework. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

EUVD-2025-26641

Malicious code in bioql PyPI...

SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:03446-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03446-1 advisory. - CVE-2025-59681: SQL injection via the QuerySet annotate, alias, aggregate, or extra methods when processing a specially crafte...

The vulnerabilities of the QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods in the Django web application framework allow attackers to influence the confidentiality and integrity of the protected information.

The vulnerability of the QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra methods in the Django web application framework is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to influence the confidentialit...

PYSEC-2025-106

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwarg...

CVE-2025-59681

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwarg...

CVE-2025-59681

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the kwarg...

OESA-2025-2354 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...

The vulnerability of the annotate() and alias() functions in the Django web application framework allows a hacker to execute arbitrary code.

The vulnerability of the LoginView, LogoutView, and setlanguage functions in the Django web application framework is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

django: Django SQL injection in FilteredRelation column aliases

An SQL injection flaw has been discovered in the Django web framework. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

django: Django SQL injection in FilteredRelation column aliases

An SQL injection flaw has been discovered in the Django web framework. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed QuerySet.annotate or QuerySet.alias...

Malicious code in ove-auto-annotate (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73d921bb6f1f70021ae12802fbc01223f7ad55bdf036a5b565142f3d82af4aa3 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47338 Malicious code in ove-auto-annotate (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73d921bb6f1f70021ae12802fbc01223f7ad55bdf036a5b565142f3d82af4aa3 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in swc-plugin-component-annotate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65e72154327975b96053186a0016efcacea667730e163b10f507b40b94254047 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47210 Malicious code in swc-plugin-component-annotate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65e72154327975b96053186a0016efcacea667730e163b10f507b40b94254047 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] [DLA 4301-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4301-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 15, 2025 https://wiki.debian.org/LTS -...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

PT-2025-37519

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a data-race condition within the kcm Kernel Connection Multiplexor subsystem. Specifically, kcm-rx psock can be read without a lock in the kcm rfree function,...