Djangoproject Django
153 CVEs affecting Djangoproject Django. Latest disclosed: 2026-07-07. Critical: 12, High: 43.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-4277 | Critical | 9.8 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissions on inline model instances were not validated on submissi… |
CVE-2024-53908 | Critical | 9.8 | 2024-12-06 | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, w… |
CVE-2023-31047 | Critical | 9.8 | 2023-05-07 | In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. T… |
CVE-2022-34265 | Critical | 9.8 | 2022-07-04 | An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untruste… |
CVE-2022-28347 | Critical | 9.8 | 2022-04-12 | A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a craft… |
CVE-2022-28346 | Critical | 9.8 | 2022-04-12 | An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject… |
CVE-2021-35042 | Critical | 9.8 | 2021-07-02 | Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application. |
CVE-2020-7471 | Critical | 9.8 | 2020-02-03 | Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django ap… |
CVE-2019-19844 | Critical | 9.8 | 2019-12-18 | Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's em… |
CVE-2019-14234 | Critical | 9.8 | 2019-08-09 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and in… |
CVE-2016-9013 | Critical | 9.8 | 2016-12-09 | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests wit… |
CVE-2025-64459 | Critical | 9.1 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get… |
CVE-2022-36359 | High | 8.8 | 2022-08-03 | An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file downl… |
CVE-2020-9402 | High | 8.8 | 2020-03-05 | Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions an… |
CVE-2016-9014 | High | 8.1 | 2016-12-09 | Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding… |
CVE-2026-3902 | High | 7.5 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` allows a remote attacker to spoof headers by exploiting an… |
CVE-2026-33034 | High | 7.5 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-Length` header coul… |
CVE-2026-25673 | High | 7.5 | 2026-03-03 | An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. `URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which… |
CVE-2026-1285 | High | 7.5 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (w… |
CVE-2025-14550 | High | 7.5 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-se… |