django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2026-78679 via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

SummaryWhile investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies.In the tested...

django-omnibus (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-82397 via tornado (3.1.1)

tornado PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - django-omnibus =0.1.0, =0.2.0 Source cves: CVE-2026-82397 Source advisory: OSV:PYSEC-2026-3928...

PYSEC-2026-3827 Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

SummaryAdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request.If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's G...

PYSEC-2026-3828 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

PYSEC-2026-3822 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

SummaryThe moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

SummaryThe CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of...

PYSEC-2026-3824 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

djangocms-lab-carousel (0.2.1), djangocms-shiny-app (0.1.3) potentially affected by CVE-2026-54625 via django-cms (3.1.7)

django-cms PYPI version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-lab-carousel 0.2.1 - djangocms-shiny-app 0.1.3 Source cves: CVE-2026-54625 Source advisory: OSV:PYSEC-2026-3824...

djangocms-highlightjs (0.4.0), djangocms-lab-publications (0.1.4) potentially affected by CVE-2026-54625 via django-cms (3.3.1)

django-cms PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-highlightjs 0.4.0 - djangocms-lab-publications 0.1.4 Source cves: CVE-2026-54625 Source advisory: OSV:PYSEC-2026-3824...

aldryn-events (2.0.0), aldryn-people (2.0.0) +7 more potentially affected by CVE-2026-54625 via django-cms (3.5.4)

django-cms PYPI version 3.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events 2.0.0 - aldryn-people 2.0.0 - aldryn-reversion =1.0.7, =0.2.0, =0.6.2, =0.3.0, =0.3.5 - emencia-contact-form 0.3.0 Source cves...

django-shop (1.2.4), djangocms-algolia (>=0.1.0.0, <=1.3.2.0) +8 more potentially affected by CVE-2026-54625 via django-cms (3.11.3)

django-cms PYPI version 3.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-shop 1.2.4 - djangocms-algolia =0.1.0.0, =1.0.0, =1.0.0, =0.2.0.0, =0.0.0.1, =1.0.0.0 - djangoshop-gestpay 0.1.0 - djangoshop-wspay...

cmsplugin-blocks (>=1.3.0, <=1.5.3), cmsplugin-css-background (>=0.1.0, <=0.2.0) +36 more potentially affected by CVE-2026-54625 via django-cms (3.11.11)

django-cms PYPI version 3.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - cmsplugin-blocks =1.3.0, =0.1.0, =0.0.3, =2.0.0, =3.6.2, =7.0.4, =1.3.3.0, =0.6.0a3, =0.2.0, =0.0.2, =0.1.0, =0.3.0 and more Source cves:...

django-cms-qe (1.4.3), django-oscar-moysklad (>=0.2.4, <=0.2.5) +1 more potentially affected by CVE-2026-54625 via django-cms (3.5.2)

django-cms PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - django-cms-qe 1.4.3 - django-oscar-moysklad =0.2.4, =0.2.5 - richie 0.1.0 Source cves: CVE-2026-54625 Source advisory: OSV:PYSEC-2026-3824...

djangocms-plugie (0.1.4) potentially affected by CVE-2026-54625 via django-cms (3.7.0rc2)

django-cms PYPI version 3.7.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-plugie 0.1.4 Source cves: CVE-2026-54625 Source advisory: OSV:PYSEC-2026-3824...

aldryn-forms (>=3.0.4, <=3.0.5), django-cms-qe (>=2.0.0, <=2.2.0) +5 more potentially affected by CVE-2026-54625 via django-cms (3.7.4)

django-cms PYPI version 3.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-forms =3.0.4, =2.0.0, =0.1.0, =0.1.0, =0.2.4 - taccsite-cms 3.6.0a0 Source cves: CVE-2026-54625 Source advisory: OSV:PYSEC-2026-3824...

richie (2.15.1) potentially affected by CVE-2026-54625 via django-cms (3.11.0)

django-cms PYPI version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - richie 2.15.1 Source cves: CVE-2026-54625 Source advisory: OSV:PYSEC-2026-3824...

aldryn-events (>=1.1.1, <=1.1.3), aldryn-faq (1.2.1) +4 more potentially affected by CVE-2026-54625 via django-cms (3.3.4)

django-cms PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - aldryn-events =1.1.1, =1.1.3 - aldryn-faq 1.2.1 - aldryn-people 1.2.1 - cmsplugin-articles-ai 0.1.1 - cmsplugin-carousel-ai 0.0.3 -...