PT-2025-4385

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.182.0 through 0.257.0 Description A type confusion vulnerability exists in Strawberry GraphQL's relay integration, affecting multiple ORM integrations, including Django, SQLAlchemy, and Pydantic. This issue occurs...

CVE-2024-56113: Insecure Storage of Sensitive Information

Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on DEBUG = True and exposing sensitive information defined in Django settings file through verbose error page...

openSUSE Security Advisory (openSUSE-SU-2025:0008-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15 Security Update : python-django-ckeditor (openSUSE-SU-2025:0008-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2025:0008-1 advisory. - Update to 6.7.2 Deprecated the package. Added a new ckeditor/fixups.js script which disables the version check again if something slips through by...

OPENSUSE-SU-2025:0008-1 Security update for python-django-ckeditor

This update for python-django-ckeditor fixes the following issues: - Update to 6.7.2 Deprecated the package. Added a new ckeditor/fixups.js script which disables the version check again if something slips through by accident and which disables the behavior where CKEditor 4 would automatically...

Security update for python-django-ckeditor (moderate)

openSUSE Security Update: Security update for python-django-ckeditor Announcement ID: openSUSE-SU-2025:0008-1 Rating: moderate References: 1219720 Cross-References: CVE-2024-24815 Affected Products: openSUSE Backports SLE-15-SP5 An update that fixes one vulnerability is now available. Description...

SQL Injection

Django is vulnerable to SQL injection. The vulnerability exists due to the improper handling of untrusted data in the django.db.models.fields.json.HasKey lookup when used with an Oracle database, allowing attackers to execute arbitrary SQL commands...

Denial Of Service (DoS)

Django is vulnerable to a denial-of-service DoS attack. The vulnerability is due to the striptags method and striptags template filter failing to handle inputs with large sequences of nested incomplete HTML entities, allowing an attacker to perform a DoS attack with specially crafted inputs...

Timing Attack

Overview django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party social account authentication. Affected versions of this package are vulnerable to Timing Attack in the AuthenticationBackend.authenticatebyemail...

bma (0.2.0a1), fiduswriter (>=4.0.0rc2, <=4.0.19) +2 more potentially affected by unknown CVE via django-allauth (>=65.0.0, <=65.2.0)

django-allauth PYPI version =65.0.0, =4.0.0rc2, =0.163.0, =2.0.0, =2.0.3 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DJANGOALLAUTH-8600545...

PT-2025-51215

Name of the Vulnerable Software and Affected Versions allauth-django versions prior to 65.13.0 Description An issue existed where access and refresh tokens were not rejected after a user was marked as inactive. Specifically, if a user’s account was deactivated is active=False after tokens had...

PT-2025-51216

Name of the Vulnerable Software and Affected Versions allauth-django versions prior to 65.13.0 Description An issue exists in allauth-django where Okta and NetIQ were utilizing the preferred username value as an identifier for third-party provider accounts. This value is mutable and should not be...

[SECURITY] [DLA 4006-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4006-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb December 31, 2024 https://wiki.debian.org/LTS -...

DLA-4006-1 python-django - security update

Bulletin has no description...

Debian dla-4006 : python-django-doc - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4006 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4006-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-56363 APTRS has SSTI vulnerability

APTRS Automated Penetration Testing Reporting System is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input that is incorporated into a Jinja2...

CVE-2024-56363 APTRS has SSTI vulnerability

APTRS Automated Penetration Testing Reporting System is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input that is incorporated into a Jinja2...

CVE-2024-56363: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

APTRS Automated Penetration Testing Reporting System is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input that is incorporated into a Jinja2...

APTRS security vulnerabilities

APTRS Automated Penetration Testing Reporting System is a Python and Django based automated reporting tool from APTRS open source. Designed for penetration testers and security organizations. A security vulnerability exists in version 1.0 of APTRS, which stems from improper input cleanup in a web...

Django strip_tags() DoS

The vulnerability of the striptags function in the django.utils.html module of the Django software framework relates to unlimited resource allocation due to improper escaping of HTML characters. Exploiting this vulnerability could allow a malicious actor to cause service interruptions by sending...