EUVD-2026-87371

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-86066

The HR and CRM software Horilla is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions prior to 2.0.0 . The approve_validate_attendance_request function at /attendance/approve-validate-attendance-request/ performs state-changing actions (such as updating attendance_validated and ap...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-63432

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

EUVD-2026-87363

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432

The Horilla HR and CRM software (versions 1.0.0 until 1.6.0 and 2.0.0) contains a Server-Side Template Injection (SSTI) vulnerability. The get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render user-controlled content while including the full request...

CLSA-2026-1790339542 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post21+tuxcare...

DEBIAN-CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

UBUNTU-CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

Brute Force

Overview django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party social account authentication. Affected versions of this package are vulnerable to Brute Force in the failed login attempt rate-limiting logic, an...

CVE-2026-97764

The django-allauth library, in versions before 65.19.4 , contains a vulnerability where failed login attempt limits are not properly enforced. In certain common configurations, an attacker can exploit the way the system handles diacritics (such as accents) to bypass these limits, allowing for a h...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

CVE-2026-97764

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

EUVD-2026-86517

django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics e.g., accents for a higher effective limit...

Linux Distros Unpatched Vulnerability : CVE-2026-97764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the...

automation-controller: automation-controller-container: automation-controller: format string injection in the API 4XX error log setting discloses Django SECRET_KEY and database credentials to an administrator

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...