python-Django (SUSE:Linux Enterprise Module for Package Hub 15 SP7) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Package Hub 15 SP7 package python-Django, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (20)

• CVE-2025-64459 — CVSS 9.1 (critical): An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`…
• CVE-2026-1285 — CVSS 7.5 (high): An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and…
• CVE-2025-64460 — CVSS 7.5 (high): An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xm…
• CVE-2025-14550 — CVSS 7.5 (high): An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a…
• CVE-2025-57833 — CVSS 7.1 (high): An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection…
• CVE-2025-59681 — CVSS 7.1 (high): An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias()…
• CVE-2026-1207 — CVSS 5.4 (medium): An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented…
• CVE-2026-1287 — CVSS 5.4 (medium): An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in…
• CVE-2026-1312 — CVSS 5.4 (medium): An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection…
• CVE-2025-32873 — CVSS 5.3 (medium): An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is…
• CVE-2025-13473 — CVSS 5.3 (medium): An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. The `django.contrib.auth.handlers.modwsgi.check_passw…
• CVE-2025-13372 — CVSS 4.3 (medium): An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in…
• CVE-2025-48432 — CVSS 4.0 (medium): An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not…
• CVE-2026-25674 — CVSS 3.7 (low): An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. Race condition in file-system storage and file-based…
• CVE-2026-48587 — CVSS 3.1 (low): An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip…
• CVE-2026-6873 — CVSS 3.1 (low): An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a…
• CVE-2026-7666 — CVSS 3.1 (low): An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to…
• CVE-2025-59682 — CVSS 3.1 (low): An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function…
• CVE-2026-8404 — CVSS 3.1 (low): An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does…
• CVE-2026-35193 — CVSS 3.1 (low): An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does…