CVE Tools
Track your stack

Django

179 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Django, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Django CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Django CVEs per month
MonthCVEs
2024-122
2025-011
2025-020
2025-031
2025-041
2025-051
2025-061
2025-071
2025-080
2025-091
2025-102
2025-112
2025-122
2026-010
2026-026
2026-032
2026-045
2026-053
2026-065
2026-073
2026-084
2026-090
2026-104
2026-116

Severity

How the 179 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical158%
  • High4827%
  • Medium10257%
  • Low148%

Latest CVEs

The 15 most recently published vulnerabilities affecting Django.

  1. CVE-2026-114582Server-side request forgery via SpatialReference string input5.3
  2. CVE-2026-113733Password hash disclosure to "view only" admin users with custom user models2.2
  3. CVE-2026-113593Potential exposure of private data via empty and missing Vary headers3.1
  4. CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometries5.3
  5. CVE-2026-111211Potential log injection via unescaped geometry form values5.3
  6. CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file upload5.3
  7. CVE-2026-87975Privilege abuse in model formsets with editable primary keys4.3
  8. CVE-2026-87890Potential request forgery via spatial lookup byte values5.3
  9. CVE-2026-84429Potential denial-of-service vulnerability in HTTP header parsing5.3
  10. CVE-2026-77050Potential denial-of-service vulnerability in get_supported_language_variant()5.3
  11. CVE-2026-15920Potential cross-site scripting via URLField values in the admin6.1
  12. CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collections5.3
  13. CVE-2026-15337Potential denial-of-service vulnerability in check_for_language()5.3
  14. CVE-2026-15307Server-side file-write and request forgery via spatial lookups8.8
  15. CVE-2026-53878Header injection possibility since DomainNameValidator accepted newlines in input6.1

Product grouping is registry-driven, with AI assist and human review. How it works