Количество 10
Количество 10
GHSA-qpc8-7fxc-cm4p
Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary
CVE-2026-35193
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
CVE-2026-35193
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
CVE-2026-35193
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
CVE-2026-35193
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0 ...
ROS-20260707-80-0026
Уязвимость python-django
BDU:2026-10403
Уязвимость модуля django.middleware.cache.UpdateCacheMiddleware программной платформы для веб-приложений Django, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
ROS-20260707-73-0028
Уязвимость python-django
openSUSE-SU-2026:20937-1
Security update for python-Django
SUSE-SU-2026:2318-1
Security update for python-Django
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-qpc8-7fxc-cm4p Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary | CVSS3: 3.1 | 0% Низкий | 3 месяца назад |
 | CVE-2026-35193 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue. | CVSS3: 3.1 | 0% Низкий | 3 месяца назад |
 | CVE-2026-35193 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue. | CVSS3: 3.1 | 0% Низкий | 3 месяца назад |
 | CVE-2026-35193 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue. | CVSS3: 3.1 | 0% Низкий | 3 месяца назад |
| CVE-2026-35193 An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0 ... | CVSS3: 3.1 | 0% Низкий | 3 месяца назад |
 | ROS-20260707-80-0026 Уязвимость python-django | CVSS3: 5.3 | 0% Низкий | 2 месяца назад |
 | BDU:2026-10403 Уязвимость модуля django.middleware.cache.UpdateCacheMiddleware программной платформы для веб-приложений Django, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации | CVSS3: 3.1 | 0% Низкий | 3 месяца назад |
| ROS-20260707-73-0028 Уязвимость python-django | CVSS3: 5.3 | 0% Низкий | 2 месяца назад |
 | openSUSE-SU-2026:20937-1 Security update for python-Django | 3 месяца назад | ||
| SUSE-SU-2026:2318-1 Security update for python-Django | 3 месяца назад |
Уязвимостей на страницу