https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:09:47.922646+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2020-05726 bdu:2020-05726 2026-10-03T06:09:47.978811+00:00 bdu:2020-05726 https://cve.radiocsirt.org/vuln/bit-django-2020-9402 BIT-django-2020-9402 2026-10-03T06:09:47.978854+00:00

Affected: Bitnami: django

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

 https://cve.radiocsirt.org/vuln/euvd-2026-39108 EUVD-2026-39108 2026-10-03T06:09:47.978886+00:00 EUVD-2026-39108 https://cve.radiocsirt.org/vuln/fkie_cve-2020-9402 fkie_cve-2020-9402 2026-10-03T06:09:47.978900+00:00

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

 https://cve.radiocsirt.org/vuln/ghsa-3gh2-xw74-jmcw GHSA-3gh2-xw74-jmcw — SQL injection in Django 2026-10-03T06:09:47.978921+00:00

Affected: PyPI: Django

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

 https://cve.radiocsirt.org/vuln/gsd-2020-9402 gsd-2020-9402 2026-10-03T06:09:47.978944+00:00 gsd-2020-9402 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11205-1 openSUSE-SU-2024:11205-1 — python36-Django-3.2.7-2.3 on GA media 2026-10-03T06:09:47.978955+00:00

python36-Django-3.2.7-2.3 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2020-345 Withdrawn: PYSEC-2020-345 2026-10-03T06:09:47.978987+00:00

Withdrawn by the publisher.

Affected: PyPI: django

Withdrawn as duplicate of PYSEC-2020-36. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

 https://cve.radiocsirt.org/vuln/rhsa-2021:1313 RHSA-2021:1313 — Red Hat Security Advisory: Satellite 6.9 Release 2026-10-03T06:09:47.979007+00:00

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses rubygem-rest-client: unsanitized application logging foreman: Managing repositories with their id via hammer does not respect the role filters rack-protection: Timing attack in authenticity_token.rb rubygem-rack: hijack sessions by using timing attacks targeting the session id python-psutil: Double free because of refcount mishandling rubygem-activestorage: circumvention of file size limits in ActiveStorage rubygem-actionpack: possible strong parameters bypass rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token rubygem-actionview: CSRF vulnerability in rails-ujs rubygem-rails: untrusted users able to run pending migrations in production django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle netty: compression/decompression codecs don't enforce limits on buffer allocation sizes foreman: world-readable OMAPI secret through the ISC DHCP server rubygem-activeview: Cross-site scripting in translation helpers resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-9402 UBUNTU-CVE-2020-9402 2026-10-03T06:09:47.979050+00:00

Affected: Ubuntu:16.04:LTS: python-django, Ubuntu:18.04:LTS: python-django

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.