[SECURITY] [DLA 4843-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 19, 2026 https://wiki.debian.org/LTS -...

Debian dla-4843 : python-django-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4843 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected]...

CVE-2026-87975

A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by...

CVE-2026-87975

A privilege abuse vulnerability exists in Django versions 6.1 before 6.1.2 , 6.0 before 6.0.9 , and 5.2 before 5.2.18 . The root cause lies in django.forms.models.BaseModelFormSet.save_existing_objects(), which incorrectly assumes that the presence of a primary key in submitted data confirms the ...

CVE-2026-87975 Privilege abuse in model formsets with editable primary keys

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

CVE-2026-87975 Privilege abuse in model formsets with editable primary keys

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

SUSE CVE-2013-0306

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service memory consumption or trigger server errors via a modified maxnum parameter...

PT-2013-2220

Name of the Vulnerable Software and Affected Versions Django versions 1.3.x through 1.3.5 Django versions 1.4.x through 1.4.3 Django versions 1.5 before release candidate 2 Description The issue allows remote attackers to bypass intended resource limits for formsets, potentially causing a denial ...

USN-1757-1: Django vulnerabilities

James Kettle discovered that Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users. Although this issue had been previously addressed in USN-1632-1, this update adds additional hardening...