Vulnerabilidades em djangoproject
52 resultadosAnálise Vexday
Django apresenta 38 vulnerabilidades cadastradas, com 13 publicadas nos últimos 90 dias, indicando atividade contínua de descoberta de falhas. Apenas 2 vulnerabilidades críticas foram identificadas e nenhuma está sendo explorada ativamente (KEV), sugerindo risco moderado no curto prazo. A fraqueza dominante (CWE-770) aponta para problemas de alocação de recursos, recomendando monitoramento de patches e revisão de configurações de limite em ambientes de produção.
CVE-2026-33034HIGHPotential denial-of-service vulnerability in ASGI requests via memory upload limit bypassEPSS 0.8%CVE-2025-13473MEDIUMUsername enumeration through timing difference in mod_wsgi authentication handlerEPSS 0.8%CVE-2025-59681HIGHAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySeEPSS 0.6%CVE-2026-15337MEDIUMPotential denial-of-service vulnerability in check_for_language()EPSS 0.6%CVE-2026-108147MEDIUMPotential memory exhaustion in MultiPartParser via base64-encoded file uploadEPSS 0.6%CVE-2026-35192LOWSession fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTEPSS 0.5%CVE-2026-111211MEDIUMPotential log injection via unescaped geometry form valuesEPSS 0.5%CVE-2026-111362MEDIUMServer-side request forgery via crs member of GeoJSON geometriesEPSS 0.5%CVE-2026-53877MEDIUMHeap buffer over-read in GDALRasterEPSS 0.5%CVE-2026-84429MEDIUMPotential denial-of-service vulnerability in HTTP header parsingEPSS 0.5%CVE-2026-77050MEDIUMPotential denial-of-service vulnerability in get_supported_language_variant()EPSS 0.5%CVE-2026-4277CRITICALPrivilege abuse in GenericInlineModelAdminEPSS 0.5%CVE-2026-113593LOWPotential exposure of private data via empty and missing Vary headersEPSS 0.5%CVE-2026-3902HIGHASGI header spoofing via underscore/hyphen conflationEPSS 0.4%CVE-2026-114582MEDIUMServer-side request forgery via SpatialReference string inputEPSS 0.4%CVE-2026-48588LOWPotential exposure of private data via cached Set-Cookie responseEPSS 0.4%CVE-2026-5766MEDIUMPotential denial-of-service vulnerability in ASGI requests via file upload limit bypassEPSS 0.4%CVE-2026-113733LOWPassword hash disclosure to "view only" admin users with custom user modelsEPSS 0.4%CVE-2026-25674LOWPotential incorrect permissions on newly created file system objectsEPSS 0.4%CVE-2026-35193LOWPotential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewareEPSS 0.4%