Exposição de Django
Web frameworks55
score de exposição
26.142
sites usam
0
em exploração
2
críticos
Análise Vexday
O histórico de vulnerabilidades catalogadas para o Django totaliza 33 CVEs, das quais nenhuma consta atualmente no catálogo CISA KEV, taxa abaixo da média geral do catálogo — o que indica ausência de exploração ativa confirmada no momento. Ainda assim, o volume recente merece atenção: 13 CVEs surgiram nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes. O tipo de falha mais comum é CWE-89 (injeção de SQL), e a CVE mais perigosa ativa hoje, CVE-2025-64459, apresenta EPSS de 0,1914 — probabilidade não desprezível de exploração que, somada às 2 CVEs de severidade crítica no portfólio, recomenda atenção contínua ao ciclo de atualização em ambientes que utilizam o framework.
CVEs
50 resultadosCVE-2026-33034HIGHPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypassEPSS 0.8%CVE-2025-13473MEDIUMUsername enumeration through timing difference in mod_wsgi authentication handlerEPSS 0.8%CVE-2025-59681HIGHAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySeEPSS 0.6%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 0.6%CVE-2026-108147MEDIUMPotential memory exhaustion in MultiPartParser via base64-encoded file uploadEPSS 0.6%CVE-2026-35192LOWSession fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTEPSS 0.5%CVE-2026-111211MEDIUMPotential log injection via unescaped geometry form valuesEPSS 0.5%CVE-2026-111362MEDIUMServer-side request forgery via crs member of GeoJSON geometriesEPSS 0.5%CVE-2026-53877MEDIUMHeap buffer over-read in GDALRasterEPSS 0.5%CVE-2026-84429MEDIUMPotential denial-of-service vulnerability in HTTP header parsingEPSS 0.5%CVE-2026-77050MEDIUMPotential denial-of-service vulnerability in get_supported_language_variant()EPSS 0.5%CVE-2026-4277CRITICALPrivilege abuse in GenericInlineModelAdminEPSS 0.5%CVE-2026-113593LOWPotential exposure of private data via empty and missing Vary headersEPSS 0.5%CVE-2026-3902HIGHASGI header spoofing via underscore/hyphen conflationEPSS 0.4%CVE-2026-114582MEDIUMServer-side request forgery via SpatialReference string inputEPSS 0.4%CVE-2026-48588LOWPotential exposure of private data via cached Set-Cookie responseEPSS 0.4%CVE-2026-5766MEDIUMPotential denial-of-service vulnerability in ASGI requests via file upload limit bypassEPSS 0.4%CVE-2026-113733LOWPassword hash disclosure to "view only" admin users with custom user modelsEPSS 0.4%CVE-2026-25674LOWPotential incorrect permissions on newly created file system objectsEPSS 0.4%CVE-2026-35193LOWPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewareEPSS 0.4%