https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:10:20 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-14986 bdu:2026-14986 https://cve.radiocsirt.org/vuln/bdu:2026-14986 https://cve.radiocsirt.org/vuln/bit-django-2026-48588 <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> https://cve.radiocsirt.org/vuln/bit-django-2026-48588 https://cve.radiocsirt.org/vuln/euvd-2026-333698 EUVD-2026-333698 https://cve.radiocsirt.org/vuln/euvd-2026-333698 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48588 <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48588 https://cve.radiocsirt.org/vuln/ghsa-3h9f-r86x-qvjx <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-3h9f-r86x-qvjx https://cve.radiocsirt.org/vuln/oesa-2026-3074 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie&amp;amp;#39;s response header does not change, but &amp;amp;quot;SESSION_SAVE_EVERY_REQUEST&amp;amp;quot; is &amp;amp;quot;true&amp;amp;quot;. A remote attacker could steal a user&amp;amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not been evaluated and may also be affected. Django thanks Cantina for reporting this issue.(CVE-2026-35192)</p> <p>An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.(CVE-2026-35193)</p> <p>An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via request…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie&amp;amp;#39;s response header does not change, but &amp;amp;quot;SESSION_SAVE_EVERY_REQUEST&amp;amp;quot; is &amp;amp;quot;true&amp;amp;quot;. A remote attacker could steal a user&amp;amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not been evaluated and may also be affected. Django thanks Cantina for reporting this issue.(CVE-2026-35192)</p> <p>An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.(CVE-2026-35193)</p> <p>An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via request…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3074 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11235-1 <p>python313-Django4-4.2.30-4.1 on GA media</p> <p>python313-Django4-4.2.30-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11235-1 https://cve.radiocsirt.org/vuln/pysec-2026-2090 <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2090 https://cve.radiocsirt.org/vuln/suse-su-2026:2819-1 <p>Security update for python-Django</p> <p>Security update for python-Django</p> https://cve.radiocsirt.org/vuln/suse-su-2026:2819-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48588 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48588 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2231 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen und Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen, einen Denial of Service zu verursachen und Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2231