8882 matches found
PT-2026-83461
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post3+tuxcare...
PT-2026-80659
Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARE CLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
ROS-20260819-73-0076
The vulnerability in Python-Django is related to a race condition that occurs outside the buffer boundaries of memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-68923
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...
MobSF's CSRF checks not enforced after Django migration
Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
GHSA-3P54-567P-2WPR MobSF's CSRF checks not enforced after Django migration
Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...
CVE-2026-68923 MobSF: CSRF checks not enforced after Django migration
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...
CVE-2026-68923
In MobSF versions before 4.5.1, settings.py placed CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES tuple, omitting it from the active MIDDLEWARE tuple. This left authenticated endpoints (/delete_scan/, /upload/, /change_password/, /create_user/, /delete_user/) without CSRF protection...
EUVD-2026-61134
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...
CVE-2026-68923 MobSF: CSRF checks not enforced after Django migration
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...
CVE-2026-68923 MobSF: CSRF checks not enforced after Django migration
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...
BIT-DJANGO-2026-15920 Potential cross-site scripting via URLField values in the admin
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
CLSA-2026-1787042978 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post5+tuxcare...
CLSA-2026-1787036530 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post9+tuxcare...
CLSA-2026-1787028657 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post4+tuxcare...
PT-2026-83043
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post5+tuxcare...
PT-2026-83036
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post9+tuxcare...
PT-2026-83032
TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post4+tuxcare...
PT-2026-77244
Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1 Description In the settings.py file, the django.middleware.csrf.CsrfViewMiddleware is placed only in the deprecated MIDDLEWARE CLASSES setting and omitted from the active MIDDLEWARE tuple. This configuration error...
PT-2026-79854
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.display for field renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...