177 matches found
CLSA-2025-1759882283 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post1+tuxcare...
CLSA-2025-1757549494 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.post3+tuxcare...
CLSA-2025-1756858299 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.1.post3+tuxcare...
CLSA-2025-1760659889 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post5+tuxcare...
CVE-2026-16206
Affected software: django-oauth-toolkit 3.3.0. Root cause: manipulation in the function _load_id_token within oauth2_provider/oauth2_validators.py. Impact as stated: session expiration. Attack can be initiated remotely over the network. Status of remediation: not provided in the connected documen...
OPENSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media
These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed...
SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:2819-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2819-1 advisory. This update for python-Django fixes the following issues - CVE-2026-48588: potential exposure of private data via cached Set-Cookie response...
GHSA-3H9F-R86X-QVJX Django: cache middleware may expose private responses when unrelated request cookies are present
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier,...
OESA-2026-2659 python-django security update
A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the Vary response header...
Security update for python-Django (important)
openSUSE security update: security update for python-django ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20937-1 Rating: important References: bsc1267576 bsc1267577 bsc1267578 bsc1267579 bsc1267580 Cross-References: CVE-2026-35193 CVE-2026-48587...
SUSE-SU-2026:2318-1 Security update for python-Django
This update for python-Django fixes the following issues - CVE-2026-6873: signed cookie salt namespace collision in django.http.HttpRequest.getsignedcookie bsc1267578. - CVE-2026-7666: potential unencrypted email transmission via STARTTLS in the SMTP backend bsc1267579. - CVE-2026-8404: potential...
PYSEC-2026-201
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their...
PYSEC-2026-198
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.django.utils.cache.hasvaryheader in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose...
python311-Django-5.2.13-1.1 on GA media (moderate)
python311-Django-5.2.13-1.1 on GA media Announcement ID: openSUSE-SU-2026:10567-1 Rating: moderate Cross-References: CVE-2026-33033 CVE-2026-33034 CVE-2026-3902 CVE-2026-4277 CVE-2026-4292 CVSS scores: CVE-2026-33033 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2026-33033 SUSE : 6....
CVE-2026-33149
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWEDHOSTS = '' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.buildabsoluteu...
SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2026:0440-1)
The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0440-1 advisory. - CVE-2025-14550: Fixed potential denial-of-service via repeated headers when using ASGIbsc1257403 - CVE-2026-1312: Fixed potenti...
python312-Django6-6.0-1.1 on GA media (moderate)
python312-Django6-6.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10005-1 Rating: moderate Cross-References: CVE-2015-3982 CVE-2015-5145 CVE-2015-5963 CVE-2016-7401 CVE-2017-12794 CVE-2017-7233 CVE-2017-7234 CVE-2018-16984 CVE-2018-6188 CVE-2018-7536 CVE-2018-7537 CVE-2019-11358...
OESA-2025-2849 python-django security update
A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted...
OESA-2025-2679 python-django security update
A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence,...