https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:11:35 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10003 bdu:2026-10003 https://cve.radiocsirt.org/vuln/bdu:2026-10003 https://cve.radiocsirt.org/vuln/bit-django-2026-6907 <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> https://cve.radiocsirt.org/vuln/bit-django-2026-6907 https://cve.radiocsirt.org/vuln/euvd-2026-308755 EUVD-2026-308755 https://cve.radiocsirt.org/vuln/euvd-2026-308755 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6907 <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6907 https://cve.radiocsirt.org/vuln/ghsa-5hrc-gvxj-w55p <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.</p> <p>Django thanks Ahmad Sadeddin for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.</p> <p>Django thanks Ahmad Sadeddin for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-5hrc-gvxj-w55p https://cve.radiocsirt.org/vuln/oesa-2026-2217 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)</p> <p>This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie&amp;amp;#39;s response header does not change, but &amp;amp;quot;SESSION_SAVE_EVERY_REQUEST&amp;amp;quot; is &amp;amp;quot;true&amp;amp;quot;. A remote attacker could steal a user&amp;amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not b…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.(CVE-2026-33033)</p> <p>An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into memory. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Superior for reporting this issue.(CVE-2026-33034)</p> <p>This issue was discovered in version 6.0, before 6.0.5, and before 5.2.14. If the session has not been modified, the cookie&amp;amp;#39;s response header does not change, but &amp;amp;quot;SESSION_SAVE_EVERY_REQUEST&amp;amp;quot; is &amp;amp;quot;true&amp;amp;quot;. A remote attacker could steal a user&amp;amp;#39;s session after the user visits a cached public page. Earlier unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) have not b…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2217 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10708-1 <p>python311-Django4-4.2.30-2.1 on GA media</p> <p>python311-Django4-4.2.30-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10708-1 https://cve.radiocsirt.org/vuln/pysec-2026-55 <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-55 https://cve.radiocsirt.org/vuln/suse-su-2026:1740-1 <p>Security update for python-Django</p> <p>Security update for python-Django</p> https://cve.radiocsirt.org/vuln/suse-su-2026:1740-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6907 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`&#39;*&#39;`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6907 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1373 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Django ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1373