django-cms has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 7. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-639 (3) and CWE-862 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-54623High· 7.1django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django39CVE-2026-63003Medium· 6.5django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django36CVE-2026-54624Medium· 6.5django CMS: Structure endpoint bypasses page-view permission36CVE-2026-54622Medium· 6.5django CMS: Clipboard copy IDOR discloses unauthorized plugin content36CVE-2026-54625Medium· 4.8django CMS is a content management system powered by Django26
django-cms vulnerabilities
CVEs affecting django-cms, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-54623High· 7.1django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value with…
CVE-2026-54625Medium· 4.8django CMS is a content management system powered by Django
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key funct…
CVE-2026-54622Medium· 6.5django CMS: Clipboard copy IDOR discloses unauthorized plugin content
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
CVE-2026-54624Medium· 6.5django CMS: Structure endpoint bypasses page-view permission
django CMS: Structure endpoint bypasses page-view permission
CVE-2026-75526Medium· 4.4django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values…
CVE-2026-63003Medium· 6.5django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePa…
CVE-2026-61663Medium· 4.3django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff