13279 matches found
Use of Cache Containing Sensitive Information
Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the getvarycacheon process. An attacker can cause sensitive information to be disclosed to other users and manipulate cached content by priming the cache with attacker-controlled header...
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...
djangocms-htmlsitemap (0.5.0), leprikon (>=2.28.1, <=2.39.2) potentially affected by CVE-2026-54625 via django-cms (3.6.1)
django-cms PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-cms and may be impacted: - djangocms-htmlsitemap 0.5.0 - leprikon =2.28.1, =2.39.2 Source cves: CVE-2026-54625 Source advisory: OSV:GHSA-FWJF-M4QW-9F2X...
GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...
EUVD-2026-63565
django CMS: Plugin move endpoint allows cyclic reparenting DoS...
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop via the moveplugin process. An attacker can cause application workers to hang and corrupt the plugin tree by reparenting a plugin under itself or one of its descendants, resulting in infinite recursion during tree traversa...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
CLSA-2026-1787552198 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post13+tuxcare...
CLSA-2026-1787551351 TuxCare security update for django (11 CVEs)
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.post5+tuxcare...
PT-2026-84961
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.post5+tuxcare...
PT-2026-84963
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post13+tuxcare...
CVE-2026-55468: Improper Handling of Insufficient Permissions or Privileges
Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...
Rust for Secure Backend Development: A Critical Review and Extended Vulnerability Comparison with Node.Js and Django
The Rust programming language is widely credited with eliminating entire classes of memory-safety and concurrency vulnerabilities, but the security implications of adopting it in practice extend well beyond memory safety. This paper presents a critical review of prior work on Rust's security...
CLSA-2026-1787312509 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post7+tuxcare...
CLSA-2026-1787306714 TuxCare security update for django (11 CVEs)
TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.4.post3+tuxcare...