49 matches found
Security update for python-Django
This update for python-Django fixes the following issues: CVE-2026-77050: potential denial-of-service in getsupportedlanguagevariant when processing many distinct, very long language codes bsc1284481. CVE-2026-84429: potential denial-of-service attack due to quadratic time complexity when parsing...
DEBIAN-CVE-2026-87975
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...
CVE-2026-87975
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...
CVE-2026-87975: Authorization Bypass Through User-Controlled Key
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...
PT-2026-106735
Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description An issue exists in the save existing objects function within django.forms.models.BaseModelFormSet. The function incorrectly uses the...
CVE-2026-87975: Authorization Bypass Through User-Controlled Key
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...
Linux Distros Unpatched Vulnerability : CVE-2026-87975
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the...
CVE-2026-9399
A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. It is possible to initiate the atta...
PT-2026-42970
A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. It is possible to initiate the atta...
CVE-2026-38835
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
Missing Authorization
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Missing Authorization in the InlineModelAdmin.getformset function. An attacker can gain unauthorized access to add inline model...
CVE-2025-70238
A stack buffer overflow vulnerability exists in D-Link DIR-513 version 1.10 . The flaw is triggered by providing a crafted value to the curTime parameter within the goform/formSetWAN_Wizard52 endpoint. This vulnerability could potentially allow for unauthorized access or system instability. Remed...
CVE-2025-70232
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter...
CVE-2025-70232
Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetMACFilter...
CVE-2026-24105
An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18multi. The value of v1 was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd...
Tenda AC15 security vulnerabilities
The Tenda AC15 is a wireless router produced by the Chinese company Tenda. The Tenda AC15V1.0 V15.03.05.18multi version has a security vulnerability. This vulnerability stems from the lack of checking for the v1 parameter in the goform/formsetUsbUnload function, which may lead to command injectio...
CVE-2026-24105
The Tenda AC15V1.0 wireless router is vulnerable to a command injection flaw in the goform/formsetUsbUnload component. The root cause is the lack of validation for the v1 parameter, which is subsequently passed to the doSystemCmd function. An attacker could exploit this to execute arbitrary comma...
CVE-2026-24105
An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18multi. The value of v1 was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd...
CVE-2025-44872
Tenda AC9 V15.03.06.42multi was found to contain a command injection vulnerability in the formsetUsbUnload function via the deviceName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...
