CVE-2026-73229 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

CVE-2026-73228

Django REST Framework before 3.17.2 parses request.data in rest_framework/request.py Request._parse by passing the HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing DATA_UPLOAD_MAX_MEMORY_SIZE. This can allow oversized req...

EUVD-2026-56860

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117

CVE-2026-69117 : NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH re...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

PT-2026-70880

Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.17.2 Description Request data parsing in the Request. parse function within rest framework/request.py passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and...

PT-2026-70881

Name of the Vulnerable Software and Affected Versions Django REST framework versions prior to 3.17.2 Description In the rest framework/renderers.py file, the AdminRenderer.render function uses override method to simulate a GET request and directly invokes view.get without calling view.check...

CVE-2026-73229: Exposure of Sensitive Information to an Unauthorized Actor

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

PT-2026-70842

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-73228: Uncontrolled Resource Consumption

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

python313-Django5-5.2.17-1.1 on GA media (moderate)

python313-Django5-5.2.17-1.1 on GA media Announcement ID: openSUSE-SU-2026:11491-1 Rating: moderate Cross-References: CVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920 CVSS scores: CVE-2026-15307 SUSE : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2026-15307 SUSE : 9.3...

OPENSUSE-SU-2026:11491-1 python313-Django5-5.2.17-1.1 on GA media

These are all security issues fixed in the python313-Django5-5.2.17-1.1 package on the GA media of openSUSE Tumbleweed...

python313-Django4-4.2.30-5.1 on GA media (moderate)

python313-Django4-4.2.30-5.1 on GA media Announcement ID: openSUSE-SU-2026:11465-1 Rating: moderate Cross-References: CVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920 CVSS scores: CVE-2026-15307 SUSE : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2026-15307 SUSE : 9.3...