8882 matches found
PT-2026-83594
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post10+tuxcare...
PT-2026-83602
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post11+tuxcare...
PT-2026-83598
TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post7+tuxcare...
PT-2026-80221
Summary The clipboard copy paths of the copy plugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
PT-2026-80315
Summary The structure-board endpoint render object structure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via render page, but the structure endpoint does not, allowing a low-privileged staff...
PT-2026-80254
Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...
PT-2026-80281
Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...
CVE-2026-54623: Uncontrolled Recursion
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...
PT-2026-79090
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The copy plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copy plugin to clipboard and copy placeholder to clipboard paths accept source placeholder...
PT-2026-83591
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post6+tuxcare...
CLSA-2026-1787142559 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post3+tuxcare...
PYSEC-2026-3688 MobSF's CSRF checks not enforced after Django migration
Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
MobSF's CSRF checks not enforced after Django migration
SummaryDjango's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
BIT-DJANGO-2026-15830 Potential denial-of-service vulnerability via nested geometry collections
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
BIT-DJANGO-2026-15337 Potential denial-of-service vulnerability in check_for_language()
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
BIT-DJANGO-2026-15307 Server-side file-write and request forgery via spatial lookups
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
PT-2026-79852
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.check for language is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
PT-2026-79853
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
ROS-20260819-73-0075
The vulnerability in Python-Django relates to the exposure of information through caching. Exploiting this vulnerability allows an attacker to gain access to the memory of a supervisor machine or other virtual machines. This can be achieved by implementing attacks through secondary channels,...