OESA-2026-3075 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3074 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie's response header does not change, but...

OESA-2026-3076 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3077 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

django-shopit (>=0.5.0, <=0.5.2), djangoshop-gestpay (0.1.0) +2 more potentially affected by CVE-2026-16212 via django-shop (>=0.12.3, <=1.2.4)

django-shop PYPI version =0.12.3, =0.5.0, =0.1.0, =0.4.2 - djangoshop-wspay 0.1.0 Source cves: CVE-2026-16212 Source advisory: SNYK:PYTHON-DJANGOSHOP-18017929...

Race Condition

Overview django-shop is an A RESTful e-commerce framework based on Django Affected versions of this package are vulnerable to Race Condition in the Purchase Stock Handler process in shop/models/inventory.py. An attacker can cause inconsistent stock levels or unauthorized inventory modifications b...

Cleartext Storage of Sensitive Information

Overview django-blog-zinnia is an A clear and powerful weblog application powered with Django Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the entryprotection.py process. An attacker can access sensitive information by reading cleartext data...

django-blog-zinnia-namespace (0.0.0) potentially affected by CVE-2026-16213 via django-blog-zinnia (0.20.0)

django-blog-zinnia PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-blog-zinnia and may be impacted: - django-blog-zinnia-namespace 0.0.0 Source cves: CVE-2026-16213 Source advisory: SNYK:PYTHON-DJANGOBLOGZINNIA-18017930...

linhub (0.1.1), octo-drf (>=3.0.0, <=4.4.1) potentially affected by CVE-2026-16216 via django-jet (1.0.8)

django-jet PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django-jet and may be impacted: - linhub 0.1.1 - octo-drf =3.0.0, =4.4.1 Source cves: CVE-2026-16216 Source advisory: SNYK:PYTHON-DJANGOJET-18017927...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the OAuth Handler component. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into submitting malicious requests. Remediation There is no fixed version fo...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the views.py process of the Dashboard Module. An attacker can gain unauthorized access to restricted dashboard functionalities by sending crafted requests to endpoints without proper...

linhub (0.1.1), octo-drf (>=3.0.0, <=4.4.1) potentially affected by CVE-2026-16215 via django-jet (1.0.8)

django-jet PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django-jet and may be impacted: - linhub 0.1.1 - octo-drf =3.0.0, =4.4.1 Source cves: CVE-2026-16215 Source advisory: SNYK:PYTHON-DJANGOJET-18017926...

linhub (0.1.1), octo-drf (>=3.0.0, <=4.4.1) potentially affected by CVE-2026-16214 via django-jet (1.0.8)

django-jet PYPI version 1.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on django-jet and may be impacted: - linhub 0.1.1 - octo-drf =3.0.0, =4.4.1 Source cves: CVE-2026-16214 Source advisory: SNYK:PYTHON-DJANGOJET-18017928...

CVE-2026-16216

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could...

CVE-2026-16213

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entryprotection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of...

CVE-2026-16214

A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and...

CVE-2026-16215

A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released ...

CVE-2026-16212

A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to...

CVE-2026-16216

Geex-arts django-jet up to 1.0.8 contains a CSRF flaw in the OAuth Handler that can be exploited remotely. The vulnerability enables cross-site request forgery and is public, with no response from the project to the issue. The CVE reports a MEDIUM severity (CVSS 3.x/4.x family) and indicates no l...

CVE-2026-16216 geex-arts django-jet OAuth cross-site request forgery

A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could...