Djangoproject vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-15307 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.High 8.7 · Aug 4, 2026
• CVE-2026-4277 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.Critical 9.8 · Apr 7, 2026
• CVE-2026-3902 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.High 7.5 · Apr 7, 2026
• CVE-2026-33034 An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.High 7.5 · Apr 7, 2026
• CVE-2026-25673 An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.High 7.5 · Mar 3, 2026
• CVE-2026-1285 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.High 7.5 · Feb 3, 2026
• CVE-2025-14550 An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.High 7.5 · Feb 3, 2026
• CVE-2025-64460 An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.High 7.5 · Dec 2, 2025
• CVE-2025-64459 An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.Critical 9.1 · Nov 5, 2025
• CVE-2025-64458 An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.High 7.5 · Nov 5, 2025
• CVE-2025-59681 An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.High 7.1 · Oct 1, 2025
• CVE-2025-57833 An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.High 7.1 · Sep 3, 2025
• CVE-2024-53908 An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.Critical 9.8 · Dec 6, 2024
• CVE-2024-53907 An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.High 7.5 · Dec 6, 2024
• CVE-2024-45230 An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.High 7.5 · Oct 8, 2024
• CVE-2024-42005 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.High 7.3 · Aug 7, 2024
• CVE-2024-41991 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.High 7.5 · Aug 7, 2024
• CVE-2024-41990 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.High 7.5 · Aug 7, 2024
• CVE-2024-41989 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.High 7.5 · Aug 7, 2024
• CVE-2024-39614 An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.High 7.5 · Jul 10, 2024
• CVE-2024-38875 An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7.High 7.5 · Jul 10, 2024
• CVE-2024-24680 An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2.High 7.5 · Feb 6, 2024
• CVE-2023-43665 In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) areHigh 7.5 · Nov 3, 2023
• CVE-2023-41164 In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attacHigh 7.5 · Nov 3, 2023
• CVE-2023-46695 An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.High 7.5 · Nov 2, 2023