Django Directory Traversal via ssi template tag

Django Potential account hijack via password reset form

Uncontrolled Recursion in Django

Potential bypass of an upstream access control based on URL paths in Django

Path Traversal in Django

Django data leakage via querystring manipulation in admin

Code Injection in Django

Django allows enumeration of user e-mail addresses

Django is vulnerable to SQL injection in column aliases

Django Vulnerable to Cache Poisoning

Django vulnerable to information leakage in AuthenticationForm

Django vulnerable to denial-of-service attack

Django Data leakage via admin history log

Django cross-site request forgery (CSRF) vulnerability

Django bypasses validation when using one form field to upload multiple files

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Django denial-of-service vulnerability in internationalized URLs

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.

Django potential denial of service vulnerability in UsernameField on Windows

Django vulnerable to Denial of Service