Jacob Walls

Potential denial-of-service vulnerability via nested geometry collections

Potential denial-of-service vulnerability in HTTP header parsing

Privilege abuse in model formsets with editable primary keys

Server-side file-write and request forgery via spatial lookups

Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware

Potential SQL injection via QuerySet.order_by and FilteredRelation

Potential SQL injection in column aliases via control characters

Potential SQL injection via raster lookups on PostGIS

Potential exposure of private data via cached Set-Cookie response

Heap buffer over-read in GDALRaster