CVE-2026-71461: Generation of Error Message Containing Sensitive Information

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

GHSA-56V6-2FHR-WXGQ Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's helptext, which is rendered with Django's |safe filter renderfield.html, bypassing auto-escaping. In both cas...

CLSA-2026-1790061998 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post14+tuxcare...

ROS-20260922-73-0133

The vulnerability in Python-Django is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260922-73-0134

The vulnerability in Python-Django is related to incorrect external management of file names or paths. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260922-73-0132

The vulnerability in Python-Django is related to an uncontrolled recursion. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the django.core.validators.DomainNameValidator module in the Django web application framework allows a attacker to execute arbitrary code.

The vulnerability of the django.corevalidators.DomainNameValidator module in the Django web application framework is related to improper handling of line separators. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of the django.contrib.gis.gdal.GDALRaster module in the Django web application framework allows a attacker to disclose protected information or cause service failures.

The vulnerability of the django.contrib.gis.gdal.GDALRaster module in the Django web application framework is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause service...

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cache_page modules in the Django web application framework allows attackers to disclose sensitive information.

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cachepage modules in the Django web development framework relates to the disclosure of information through caching. Exploiting this vulnerability could allow an attacker to disclose sensitive...

CVE-2026-93456

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93455

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

EUVD-2026-82615

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

EUVD-2026-82616

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93455

django-page-cms through 2.0.13 fails to properly validate page permissions in its admin helper views (specifically in pages/admin/views.py). This allows any staff account with low-privilege credentials to read arbitrary page content and stored media paths, enumerate content identifiers, and acces...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93456

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. A signed-in editor visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, en...