https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:00:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-03467 bdu:2026-03467 https://cve.radiocsirt.org/vuln/bdu:2026-03467 https://cve.radiocsirt.org/vuln/bit-django-2026-1285 <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> Bitnami: django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/bit-django-2026-1285 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1056 certfr-2026-avi-1056 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1056 https://cve.radiocsirt.org/vuln/euvd-2026-267159 EUVD-2026-267159 https://cve.radiocsirt.org/vuln/euvd-2026-267159 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1285 <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1285 https://cve.radiocsirt.org/vuln/ghsa-4rrr-2h4v-f3j9 <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.</p> <p>`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.</p> <p>Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: Django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.</p> <p>`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.</p> <p>Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-4rrr-2h4v-f3j9 https://cve.radiocsirt.org/vuln/oesa-2026-1307 <p><strong>Affected:</strong> openEuler:24.03-LTS: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of &amp;quot;low&amp;quot; according to the Django security policy.(CVE-2025-13473)</p> <p>An issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)</p> <p>An issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)</p> <p>An issue was discovere…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python-django</p> <p>A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es):</p> <p>An issue was discovered in Django versions before 6.0.2, before 5.2.11, and before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` is vulnerable to a timing attack, allowing remote attackers to enumerate valid usernames. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. This issue has been rated with a severity of &amp;quot;low&amp;quot; according to the Django security policy.(CVE-2025-13473)</p> <p>An issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Jiyong Yang for reporting this issue.(CVE-2025-14550)</p> <p>An issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.(CVE-2026-1207)</p> <p>An issue was discovere…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1307 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10145-1 <p>python312-Django6-6.0.2-1.1 on GA media</p> <p>python312-Django6-6.0.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10145-1 https://cve.radiocsirt.org/vuln/pysec-2026-45 <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> PyPI: django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-45 https://cve.radiocsirt.org/vuln/rhsa-2026:14835 <p>Django: Django: Denial of Service via crafted request with duplicate headers python-markdown: denial of service via malformed HTML-like sequences Django: Django: SQL Injection via RasterField band index parameter Django: Django: Denial of Service via crafted HTML inputs Django: Django: SQL Injection via crafted column aliases Django: Django: SQL injection via crafted column aliases in QuerySet.order_by() pyOpenSSL: DTLS cookie callback buffer overflow Rails: Active Support: Active Support: Denial of Service via large scientific notation strings</p> <p>Django: Django: Denial of Service via crafted request with duplicate headers python-markdown: denial of service via malformed HTML-like sequences Django: Django: SQL Injection via RasterField band index parameter Django: Django: Denial of Service via crafted HTML inputs Django: Django: SQL Injection via crafted column aliases Django: Django: SQL injection via crafted column aliases in QuerySet.order_by() pyOpenSSL: DTLS cookie callback buffer overflow Rails: Active Support: Active Support: Denial of Service via large scientific notation strings</p> https://cve.radiocsirt.org/vuln/rhsa-2026:14835 https://cve.radiocsirt.org/vuln/suse-su-2026:0440-1 <p>Security update for python-Django</p> <p>Security update for python-Django</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0440-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-1285 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django, Ubuntu:26.04:LTS: python-django</p> <p>An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-1285 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0297 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Django ausnutzen, um SQL-Injektionen durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Django ausnutzen, um SQL-Injektionen durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0297