django has 39 CVEs on record between 2020 and 2026. Disclosures have slowed: 4 in the last 90 days after 10 in the 90 before. The busiest recent month was June 2026 with 5. The median CVSS is 5.3 (medium), with 1 rated critical. None have a confirmed exploitation report.

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: 5.3
Publish → KEV: —
Last 90 days: 4 prev 10

Products

django 39

Follow django:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

django vulnerabilities

CVEs affecting django, newest first. Open any entry for full detail, references, and exploit status.

39 CVEsRSS

CVE-2026-15830None

1mo ago

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as …

CVEs per month

Products

Worst active — by depth score

django vulnerabilities

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

Django: GDALRaster may over-read heap memory when constructed from bytes

Django: cache middleware may expose private responses when unrelated request cookies are present

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

Django: signed cookies are vulnerable to salt namespace collisions

Django: has_vary_header may expose cached responses when Vary values contain whitespace

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

Django has an Improper Handling of Length Parameter Inconsistency

Django Uses Cache Containing Sensitive Information

Django vulnerable to privilege abuse in ModelAdmin.list_editable

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

Django has potential DoS via MultiPartParser through crafted multipart uploads

Django has a Race Condition vulnerability

Django vulnerable to Uncontrolled Resource Consumption

Django has Inefficient Algorithmic Complexity

Django has Inefficient Algorithmic Complexity

Django has Observable Timing Discrepancy

Django is vulnerable to DoS via XML serializer text extraction

Django is vulnerable to SQL injection in column aliases

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Django is subject to SQL injection through its column aliases

Django Improper Output Neutralization for Logs vulnerability

Django has a denial-of-service possibility in strip_tags()

Django vulnerable to Allocation of Resources Without Limits or Throttling

Django has a potential denial-of-service vulnerability in IPv6 validation

Django SQL injection in HasKey(lhs, rhs) on Oracle

Django denial-of-service in django.utils.html.strip_tags()

Django allows enumeration of user e-mail addresses