8881 matches found
CLSA-2026-1788340809 TuxCare security update for django (3 CVEs)
TuxCare rebuilt django to address 3 CVEs. Fixed in 5.0.post9+tuxcare...
CLSA-2026-1788335220 TuxCare security update for django (5 CVEs)
TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post7+tuxcare...
CLSA-2026-1788334218 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post10+tuxcare...
PT-2026-90627
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post10+tuxcare...
PT-2026-90629
TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post7+tuxcare...
PT-2026-90670
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.post6+tuxcare...
PT-2026-90681
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post16+tuxcare...
PT-2026-90672
TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.9.post4+tuxcare...
PT-2026-90665
TuxCare rebuilt django to address 3 CVEs. Fixed in 5.0.post9+tuxcare...
CVE-2026-73229
creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:03+00:00| published-proof-of-concept| https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2...
GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...
EUVD-2026-56887
Django REST framework: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data...
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...
EUVD-2026-56888
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests...
GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...
CVE-2026-16206
A flaw was found in django-oauth-toolkit. A remote attacker can exploit a vulnerability in the loadidtoken function to manipulate session handling, leading to session expiration. This can result in a denial of service for affected users by prematurely ending their active sessions...
ROOT-APP-PYPI-CVE-2025-64459 CVE-2025-64459 in django - Patched by Root
Root has patched CVE-2025-64459 in the django package for Root:PyPI. Multiple fixed versions available...