An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…

▾ Twilightdjangoproject · djangoEPSS 0.85%via NVD

CVE-2026-1287Medium· 5.4

7mo ago

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansio…

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansio…

▾ Sunlitdjangoproject · djangoEPSS 0.80%via NVD

CVE-2026-1207Medium· 5.4PoC

7mo ago

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…

Tagged “osv”

apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

apko has a path traversal in apko dirFS which allows filesystem writes outside base

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

Django has Inefficient Algorithmic Complexity

Django has Inefficient Algorithmic Complexity

Django has Observable Timing Discrepancy

Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Wagtail has improper permission handling on admin preview endpoints

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansio…

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…

picklescan vulnerable to arbitrary file create using logging.FileHandler

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web …

Langroid has WAF Bypass Leading to RCE in TableChatAgent

SageMaker Python SDK has Exposed HMAC

Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption

picklescan missing detection by simple obfuscation of a `builtins.eval` call

Lollms has an Improper Access Control vulnerability

Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning

pip Path Traversal vulnerability

SageMaker Python SDK has Insecure TLS Configuration

mlflow Creates of Temporary File in Directory with Insecure Permissions

llama-index-core vulnerable to Uncontrolled Resource Consumption

vLLM is an inference and serving engine for large language models (LLMs)

Malicious code in marshl (PyPI)

Llama Stack exposes secret in initialization log

Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload

AutoGPT is Vulnerable to RCE via Disabled Block Execution

crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVE-2025-61730)