Django vulnerabilities and fixes

CVEs that mention Django, ranked by priority. 13 tracked.

Django has 13 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-10-21. Highest priority: CVE-2026-71238 (score 49/100).

• CVE-2026-71238 CRITICAL 9.1 DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than
• CVE-2026-15307 HIGH 8.8 UPGRADE An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistic
• CVE-2026-114138 HIGH 7.5 Django REST framework is a toolkit for building Web APIs
• CVE-2026-15830 MEDIUM 5.3 UPGRADE An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos
• CVE-2026-114136 HIGH 7.5 Django REST framework is a toolkit for building Web APIs
• CVE-2026-114137 HIGH 7.4 Django REST framework is a toolkit for building Web APIs
• CVE-2026-73228 MEDIUM 5.3 Django REST framework is a toolkit for building Web APIs
• CVE-2026-71239 HIGH 8.1 DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Temp
• CVE-2026-15337 MEDIUM 5.3 UPGRADE An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_
• CVE-2026-18818 MEDIUM 6.3 A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26
• CVE-2026-15920 MEDIUM 6.1 UPGRADE An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_
• CVE-2026-68923 MEDIUM 6.5 MobSF is a mobile application security testing tool used
• CVE-2026-73229 MEDIUM 4.3 Django REST framework is a powerful and flexible toolkit for building Web APIs

FAQ

How do I fix Django vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Django being exploited right now?

None of the tracked Django CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Django CVE should I patch first?

CVE-2026-71238 currently ranks highest (49/100): DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than .

← Back to latest CVEs