https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T08:58:53.506741+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2017-7233 CVE-2017-7233 2026-10-06T08:58:53.548096+00:00

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

 https://cve.radiocsirt.org/vuln/usn-3254-1 USN-3254-1 — python-django vulnerabilities 2026-10-06T08:58:53.548154+00:00

Affected: Ubuntu:14.04:LTS: python-django, Ubuntu:16.04:LTS: python-django

It was discovered that Django incorrectly handled numeric redirect URLs. A remote attacker could possibly use this issue to perform XSS attacks, and to use a Django server as an open redirect. (CVE-2017-7233)

Phithon Gong discovered that Django incorrectly handled certain URLs when the jango.views.static.serve() view is being used. A remote attacker could possibly use a Django server as an open redirect. (CVE-2017-7234)