Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,099 results · page 2 of 22
Aug 9, 2026A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0.CVE-2026-19335 · Other software · Jane-xiaoer · reported by VulDBLow 1.9
A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- skill-vision-control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to CVE-2026-71240 · Other software · DjangoCRM · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cMedium 4.3
DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.
- Product
- django-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at leastCVE-2026-71239 · Other software · DjangoCRM · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.1
DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.
- Product
- django-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable.CVE-2026-71238 · Other software · DjangoCRM · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cCritical 9.1
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.
- Product
- django-crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26.CVE-2026-18818 · Other software · Ehco1996 · reported by VulDBMedium 5.3
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- django-sspanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2026An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.CVE-2026-15920 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Medium 5.1
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgithub.com
Aug 4, 2026An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18.CVE-2026-15830 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Medium 6.9
An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgithub.com
Aug 4, 2026An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.CVE-2026-15337 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Medium 6.9
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Jaeyoung Jang for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgithub.com
Aug 4, 2026An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.CVE-2026-15307 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92High 8.7
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgithub.com
Jul 24, 2026Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypCVE-2026-66005 · Other software · janhq · reported by VulnCheckMedium 5.3
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.
- Product
- jan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unautCVE-2026-64822 · Other software · thiagopena · reported by VulnCheckMedium 6.9
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
- Product
- djangoSIGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase oCVE-2026-64821 · Other software · thiagopena · reported by VulnCheckMedium 5.3
djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.
- Product
- djangoSIGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A weakness has been identified in geex-arts django-jet up to 1.0.8.CVE-2026-16216 · Other software · geex-arts · reported by VulDBLow 2.1
A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-jet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A security flaw has been discovered in geex-arts django-jet up to 1.0.8.CVE-2026-16215 · Other software · geex-arts · reported by VulDBMedium 5.5
A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-jet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A vulnerability was identified in geex-arts django-jet up to 1.0.8.CVE-2026-16214 · Other software · geex-arts · reported by VulDBLow 2.1
A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-jet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20.CVE-2026-16213 · Other software · Fantomas42 · reported by VulDBMedium 4.8
A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-blog-zinnia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A vulnerability was identified in awesto django-shop up to 1.2.4.CVE-2026-16212 · Other software · awesto · reported by VulDBLow 1.3
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A flaw has been found in django-tastypie up to 0.15.1.CVE-2026-16208 · Other software · reported by VulDBLow 2.3
A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2026A vulnerability was detected in django-tastypie up to 0.15.1.CVE-2026-16207 · Other software · reported by VulDBMedium 6.3
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2026A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0.CVE-2026-16206 · Other software · django-oauth · reported by VulDBMedium 5.3
A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-oauth-toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model.CVE-2026-42168 · Other software · reported by MITRECritical 9.1
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026The Janssen Project is an open-source identity and access management (IAM) platform.CVE-2026-45795 · Other software · JanssenProject · reported by GitHubMedium 5.3
The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.
- Product
- jans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026A flaw has been found in pdeljanov Symphonia up to 0.6.0.CVE-2026-15276 · Other software · pdeljanov · reported by VulDBLow 1.9
A flaw has been found in pdeljanov Symphonia up to 0.6.0. This vulnerability affects unknown code of the component Metadata Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
- Product
- Symphonia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2026A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f.CVE-2026-15188 · Other software · manjurulhoque · reported by VulDBLow 2.1
A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component Employee Dashboard Endpoint. This manipulation of the argument role causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- django-job-portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.CVE-2026-53878 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Medium 5.3
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jul 7, 2026An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.CVE-2026-53877 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Medium 6.3
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jul 7, 2026An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.CVE-2026-48588 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54263 · Other software · wagtail · reported by GitHubHigh 7.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54262 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54261 · Other software · wagtail · reported by GitHubMedium 6.5
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54260 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026Wagtail is an open source content management system built on Django.CVE-2026-54259 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call.CVE-2026-8484 · Other software · FuseSource · reported by cvd@cert.plMedium 4.8
A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl()" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes (DoS). All versions are believed to be vulnerable. This project is unmaintained at the time of CVE assignment.
- Product
- jansi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.CVE-2026-8404 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 3, 2026An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.CVE-2026-7666 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 3, 2026An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.CVE-2026-6873 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 3, 2026An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.CVE-2026-48587 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 3, 2026daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing.CVE-2026-44546 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 3.7
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.
- Product
- daphne
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.CVE-2026-44545 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Medium 5.3
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or frames, causing excessive memory consumption and a denial of service.
- Product
- daphne
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.CVE-2026-35193 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jun 1, 2026A weakness has been identified in janet-lang janet up to 1.41.0.CVE-2026-10268 · Other software · janet-lang · reported by VulDBLow 1.9
A weakness has been identified in janet-lang janet up to 1.41.0. This vulnerability affects the function unmarshal_one_fiber of the file src/core/marsh.c. Executing a manipulation can lead to integer overflow. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. This patch is called d9b1d711ea1fde52ac73a82088b512a3e17bad0d. A patch should be applied to remediate this issue.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026A security flaw has been discovered in janet-lang janet up to 1.41.0.CVE-2026-10267 · Other software · janet-lang · reported by VulDBLow 1.9
A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.
- Product
- janet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.CVE-2026-31069 · Other software · reported by MITREHigh 8.8
BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with ROLE_ACCOUNT_MANAGER permissions can exploit this to execute arbitrary SQL commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
May 12, 2026django-s3file is a lightweight file upload input for Django and Amazon S3.CVE-2026-42196 · Other software · codingjoe · reported by GitHubCritical 9.9
django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES. Depending on how files are handled, this may lead to confidentiality and integrity issues. This vulnerability is fixed in 7.0.2.
- Product
- django-s3file
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Wagtail is an open source content management system built on Django.CVE-2026-44201 · Other software · wagtail · reported by GitHubMedium 5.3
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Wagtail is an open source content management system built on Django.CVE-2026-44200 · Other software · wagtail · reported by GitHubMedium 6.5
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Wagtail is an open source content management system built on Django.CVE-2026-44199 · Other software · wagtail · reported by GitHubMedium 6.5
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Wagtail is an open source content management system built on Django.CVE-2026-44198 · Other software · wagtail · reported by GitHubMedium 4.3
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Wagtail is an open source content management system built on Django.CVE-2026-44197 · Other software · wagtail · reported by GitHubMedium 6.5
Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.
- Product
- wagtail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.CVE-2026-6907 · Other software · djangoproject · reported by 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92Low 2.3
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. `django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmad Sadeddin for reporting this issue.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.