https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:35:25 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-13913 bdu:2025-13913 https://cve.radiocsirt.org/vuln/bdu:2025-13913 https://cve.radiocsirt.org/vuln/bit-django-2025-64459 <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> https://cve.radiocsirt.org/vuln/bit-django-2025-64459 https://cve.radiocsirt.org/vuln/euvd-2026-271804 EUVD-2026-271804 https://cve.radiocsirt.org/vuln/euvd-2026-271804 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64459 <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64459 https://cve.radiocsirt.org/vuln/ghsa-frmv-pr5f-9mcr <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-frmv-pr5f-9mcr https://cve.radiocsirt.org/vuln/oesa-2025-2676 <p><strong>Affected:</strong> openEuler:24.03-LTS: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2025-64458)</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.(CVE-2025-64459)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2025-64458)</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.(CVE-2025-64459)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2676 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15708-1 <p>python311-Django4-4.2.26-1.1 on GA media</p> <p>python311-Django4-4.2.26-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15708-1 https://cve.radiocsirt.org/vuln/pysec-2025-108 <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2025-108 https://cve.radiocsirt.org/vuln/rhsa-2025:23069 <p>event-driven-ansible: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA event-driven-ansible: Sensitive Internal Headers Disclosure in AAP EDA Event Streams aap-gateway: Improper Path Validation in Gateway Allows Credential Exfiltration axios: Axios DoS via lack of data size check github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame django: Django SQL injection</p> <p>event-driven-ansible: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA event-driven-ansible: Sensitive Internal Headers Disclosure in AAP EDA Event Streams aap-gateway: Improper Path Validation in Gateway Allows Credential Exfiltration axios: Axios DoS via lack of data size check github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame django: Django SQL injection</p> https://cve.radiocsirt.org/vuln/rhsa-2025:23069 https://cve.radiocsirt.org/vuln/suse-su-2025:4100-1 <p>Security update for python-Django</p> <p>Security update for python-Django</p> https://cve.radiocsirt.org/vuln/suse-su-2025:4100-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64459 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django</p> <p>An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank cyberstan for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-64459 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2495 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial of Service Angriff und eine SQL-Injection durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial of Service Angriff und eine SQL-Injection durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2495