https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:13:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357053 EUVD-2026-357053 https://cve.radiocsirt.org/vuln/euvd-2026-357053 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54625 <p>django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.</p> <p>django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54625 https://cve.radiocsirt.org/vuln/ghsa-fwjf-m4qw-9f2x <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The header is added to the response `Vary` header, but the CMS&#39;s own cache key does not incorporate the header values, so the first visitor&#39;s variant is served to all subsequent visitors regardless of their header values.</p> <p>### Details `_page_cache_key` (in `cms/cache/page.py`) keys only on cache prefix, site, language, path and timezone. `set_page_cache` collects the plugin-declared vary headers and calls `patch_vary_headers(response, ...)` (affecting only the emitted `Vary` header), but stores and retrieves the cached page under the header-agnostic key. `get_page_cache` therefore returns whichever variant was cached first.</p> <p>### Impact - **Information disclosure:** when a plugin varies its output on a request header (e.g. `Country-Code`), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users. - **Cache poisoning:** an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.</p> <p>Applies only when `CMS_PAGE_CACHE` is enabled and at least one plugin implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values for plugin-de…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The header is added to the response `Vary` header, but the CMS&#39;s own cache key does not incorporate the header values, so the first visitor&#39;s variant is served to all subsequent visitors regardless of their header values.</p> <p>### Details `_page_cache_key` (in `cms/cache/page.py`) keys only on cache prefix, site, language, path and timezone. `set_page_cache` collects the plugin-declared vary headers and calls `patch_vary_headers(response, ...)` (affecting only the emitted `Vary` header), but stores and retrieves the cached page under the header-agnostic key. `get_page_cache` therefore returns whichever variant was cached first.</p> <p>### Impact - **Information disclosure:** when a plugin varies its output on a request header (e.g. `Country-Code`), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users. - **Cache poisoning:** an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.</p> <p>Applies only when `CMS_PAGE_CACHE` is enabled and at least one plugin implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values for plugin-de…</p> https://cve.radiocsirt.org/vuln/ghsa-fwjf-m4qw-9f2x https://cve.radiocsirt.org/vuln/pysec-2026-3824 <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The header is added to the response `Vary` header, but the CMS&#39;s own cache key does not incorporate the header values, so the first visitor&#39;s variant is served to all subsequent visitors regardless of their header values.</p> <p>### Details `_page_cache_key` (in `cms/cache/page.py`) keys only on cache prefix, site, language, path and timezone. `set_page_cache` collects the plugin-declared vary headers and calls `patch_vary_headers(response, ...)` (affecting only the emitted `Vary` header), but stores and retrieves the cached page under the header-agnostic key. `get_page_cache` therefore returns whichever variant was cached first.</p> <p>### Impact - **Information disclosure:** when a plugin varies its output on a request header (e.g. `Country-Code`), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users. - **Cache poisoning:** an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.</p> <p>Applies only when `CMS_PAGE_CACHE` is enabled and at least one plugin implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values for plugin-de…</p> <p><strong>Affected:</strong> PyPI: django-cms</p> <p>### Summary The CMS page cache key ignores the request headers that plugins declare via `get_vary_cache_on()`. The header is added to the response `Vary` header, but the CMS&#39;s own cache key does not incorporate the header values, so the first visitor&#39;s variant is served to all subsequent visitors regardless of their header values.</p> <p>### Details `_page_cache_key` (in `cms/cache/page.py`) keys only on cache prefix, site, language, path and timezone. `set_page_cache` collects the plugin-declared vary headers and calls `patch_vary_headers(response, ...)` (affecting only the emitted `Vary` header), but stores and retrieves the cached page under the header-agnostic key. `get_page_cache` therefore returns whichever variant was cached first.</p> <p>### Impact - **Information disclosure:** when a plugin varies its output on a request header (e.g. `Country-Code`), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users. - **Cache poisoning:** an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.</p> <p>Applies only when `CMS_PAGE_CACHE` is enabled and at least one plugin implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values implements `get_vary_cache_on()`.</p> <p>### Patches Fixed in 5.0.8: the page cache now folds the request&#39;s values for plugin-de…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3824 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3001 <p>Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3001