Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "RED"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Generated from an analysis of SBOM spdx#syft#django-sspanel.json (spdx-json, sha256 5e97d09f6c8d8eb9962c38d7b061ac36de3e6bfc16b3c40cda9bae7aea20e965)."
},
{
"category": "general",
"text": "This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: inspektr_cli (fail), shieldbom (fail).",
"title": "Analysis coverage"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory",
"url": "https://ndaal.eu/csaf/ndaal-sba-draft-5e97d09f6c8d8eb9"
}
],
"title": "Vulnerabilities found in SBOM spdx#syft#django-sspanel.json",
"tracking": {
"current_release_date": "2026-10-11T12:27:02Z",
"generator": {
"engine": {
"name": "ndaal SBOM Auditor",
"version": "1.6.34"
}
},
"id": "ndaal-sba-draft-5e97d09f6c8d8eb9",
"initial_release_date": "2026-10-11T12:27:02Z",
"revision_history": [
{
"date": "2026-10-11T12:27:02Z",
"number": "0.1.0",
"summary": "Initial draft generated from an SBOM analysis."
}
],
"status": "draft",
"version": "0.1.0"
}
},
"product_tree": {
"full_product_names": [
{
"name": "aiohttp@3.8.6",
"product_id": "CSAFPID-0006"
},
{
"name": "black@23.9.1",
"product_id": "CSAFPID-0013"
},
{
"name": "certifi@2023.7.22",
"product_id": "CSAFPID-0014"
},
{
"name": "cryptography@41.0.4",
"product_id": "CSAFPID-0005"
},
{
"name": "django@4.2.6",
"product_id": "CSAFPID-0001"
},
{
"name": "djangorestframework@3.14.0",
"product_id": "CSAFPID-0009"
},
{
"name": "idna@3.4",
"product_id": "CSAFPID-0011"
},
{
"name": "markdown@3.5",
"product_id": "CSAFPID-0010"
},
{
"name": "pycryptodomex@3.19.0",
"product_id": "CSAFPID-0008"
},
{
"name": "pygments@2.16.1",
"product_id": "CSAFPID-0015"
},
{
"name": "pymysql@1.1.0",
"product_id": "CSAFPID-0002"
},
{
"name": "pyopenssl@23.2.0",
"product_id": "CSAFPID-0007"
},
{
"name": "requests@2.31.0",
"product_id": "CSAFPID-0012"
},
{
"name": "sentry-sdk@1.31.0",
"product_id": "CSAFPID-0016"
},
{
"name": "sqlparse@0.4.4",
"product_id": "CSAFPID-0003"
},
{
"name": "unknown",
"product_id": "CSAFPID-0017"
},
{
"name": "unknown@1.1.1",
"product_id": "CSAFPID-0018"
},
{
"name": "urllib3@2.0.6",
"product_id": "CSAFPID-0004"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-45803",
"notes": [
{
"category": "description",
"text": "urllib3's request body not stripped after redirect from 303 status changes request method to GET"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.0.7 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-g4mx-q9vg-27p4",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-45803"
}
]
},
{
"cve": "CVE-2023-46695",
"notes": [
{
"category": "description",
"text": "Django potential denial of service vulnerability in UsernameField on Windows"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.7 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-qmf9-6jqf-j8fq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-46695"
}
]
},
{
"cve": "CVE-2023-49081",
"notes": [
{
"category": "description",
"text": "aiohttp's ClientSession is vulnerable to CRLF injection via version"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.9.0 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-q3qx-c6g2-7pw2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-49081"
}
]
},
{
"cve": "CVE-2023-49082",
"notes": [
{
"category": "description",
"text": "aiohttp's ClientSession is vulnerable to CRLF injection via method"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.9.0 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-qvrw-v9rv-5rjx",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-49082"
}
]
},
{
"cve": "CVE-2023-49083",
"notes": [
{
"category": "description",
"text": "cryptography vulnerable to NULL-dereference when loading PKCS7 certificates"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 41.0.6 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-jfhm-5ghh-2f97",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-49083"
}
]
},
{
"cve": "CVE-2023-50782",
"notes": [
{
"category": "description",
"text": "Python Cryptography package vulnerable to Bleichenbacher timing oracle attack"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 42.0.0 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-3ww4-gg4f-jr7f",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-50782"
}
]
},
{
"cve": "CVE-2023-52323",
"notes": [
{
"category": "description",
"text": "PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0008",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.19.1 or later.",
"product_ids": [
"CSAFPID-0008",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0008",
"CSAFPID-0017"
]
}
],
"title": "GHSA-j225-cvw7-qrx7",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2023-52323"
}
]
},
{
"cve": "CVE-2024-0727",
"notes": [
{
"category": "description",
"text": "Null pointer dereference in PKCS12 parsing"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 42.0.2 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-9v9h-cgj8-h64p",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-0727"
}
]
},
{
"cve": "CVE-2024-21503",
"notes": [
{
"category": "description",
"text": "Black vulnerable to Regular Expression Denial of Service (ReDoS)"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0013",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 24.3.0 or later.",
"product_ids": [
"CSAFPID-0013",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0013",
"CSAFPID-0017"
]
}
],
"title": "GHSA-fj7x-q9j7-g6q6",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-21503"
}
]
},
{
"cve": "CVE-2024-21520",
"notes": [
{
"category": "description",
"text": "Cross-site Scripting in djangorestframework"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0009",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.15.2 or later.",
"product_ids": [
"CSAFPID-0009",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0009",
"CSAFPID-0017"
]
}
],
"title": "GHSA-gw84-84pc-xp82",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-21520"
}
]
},
{
"cve": "CVE-2024-23334",
"notes": [
{
"category": "description",
"text": "aiohttp is vulnerable to directory traversal"
},
{
"category": "other",
"text": "A public nuclei exploit template exists (severity: high).",
"title": "Nuclei template"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.9.2 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5h86-8mv2-jq9f",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-23334"
}
]
},
{
"cve": "CVE-2024-23829",
"notes": [
{
"category": "description",
"text": "aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.9.2 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8qpw-xqxj-h4r2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-23829"
}
]
},
{
"cve": "CVE-2024-24680",
"notes": [
{
"category": "description",
"text": "Django denial-of-service attack in the intcomma template filter"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.10 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-xxj9-f6rv-m3x4",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-24680"
}
]
},
{
"cve": "CVE-2024-26130",
"notes": [
{
"category": "description",
"text": "cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 42.0.4 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-6vqw-3v5j-54x4",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-26130"
}
]
},
{
"cve": "CVE-2024-27306",
"notes": [
{
"category": "description",
"text": "aiohttp Cross-site Scripting vulnerability on index pages for static file handling"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.9.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-7gpw-8wmc-pm8g",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-27306"
}
]
},
{
"cve": "CVE-2024-27351",
"notes": [
{
"category": "description",
"text": "Regular expression denial-of-service in Django"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.11 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-vm8q-m57g-pff3",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-27351"
}
]
},
{
"cve": "CVE-2024-30251",
"notes": [
{
"category": "description",
"text": "aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.9.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5m98-qgg9-wh84",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-30251"
}
]
},
{
"cve": "CVE-2024-35195",
"notes": [
{
"category": "description",
"text": "Requests `Session` object does not verify requests after making first request with verify=False"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0012",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.32.0 or later.",
"product_ids": [
"CSAFPID-0012",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0012",
"CSAFPID-0017"
]
}
],
"title": "GHSA-9wx4-h78v-vm56",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-35195"
}
]
},
{
"cve": "CVE-2024-36039",
"notes": [
{
"category": "description",
"text": "PyMySQL SQL Injection vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0002",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 1.1.1 or later.",
"product_ids": [
"CSAFPID-0002",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0002",
"CSAFPID-0017"
]
}
],
"title": "GHSA-v9hf-5j83-6xpp",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-36039"
}
]
},
{
"cve": "CVE-2024-3651",
"notes": [
{
"category": "description",
"text": "Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0011",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.7 or later.",
"product_ids": [
"CSAFPID-0011",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0011",
"CSAFPID-0017"
]
}
],
"title": "GHSA-jjg7-2v4v-x38h",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-3651"
}
]
},
{
"cve": "CVE-2024-37891",
"notes": [
{
"category": "description",
"text": "urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.2.2 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-34jh-p97f-mpxf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-37891"
}
]
},
{
"cve": "CVE-2024-38875",
"notes": [
{
"category": "description",
"text": "Django vulnerable to Denial of Service"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.14 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-qg2p-9jwr-mmqf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-38875"
}
]
},
{
"cve": "CVE-2024-39329",
"notes": [
{
"category": "description",
"text": "Django vulnerable to user enumeration attack"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.14 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-x7q2-wr7g-xqmf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-39329"
}
]
},
{
"cve": "CVE-2024-39330",
"notes": [
{
"category": "description",
"text": "Django Path Traversal vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.14 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-9jmf-237g-qf46",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-39330"
}
]
},
{
"cve": "CVE-2024-39614",
"notes": [
{
"category": "description",
"text": "Django vulnerable to Denial of Service"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.14 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-f6f8-9mx6-9mx2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-39614"
}
]
},
{
"cve": "CVE-2024-39689",
"notes": [
{
"category": "description",
"text": "Certifi removes GLOBALTRUST root certificate"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0014",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2024.7.4 or later.",
"product_ids": [
"CSAFPID-0014",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0014",
"CSAFPID-0017"
]
}
],
"title": "GHSA-248v-346w-9cwc",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-39689"
}
]
},
{
"cve": "CVE-2024-40647",
"notes": [
{
"category": "description",
"text": "Sentry's Python SDK unintentionally exposes environment variables to subprocesses"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0016",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 1.45.1 or later.",
"product_ids": [
"CSAFPID-0016",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
"baseScore": 2.5,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0016",
"CSAFPID-0017"
]
}
],
"title": "GHSA-g92j-qhmh-64v2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-40647"
}
]
},
{
"cve": "CVE-2024-41989",
"notes": [
{
"category": "description",
"text": "Django memory consumption vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-jh75-99hh-qvx9",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-41989"
}
]
},
{
"cve": "CVE-2024-41990",
"notes": [
{
"category": "description",
"text": "Django vulnerable to a denial-of-service attack"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-795c-9xpc-xw6g",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-41990"
}
]
},
{
"cve": "CVE-2024-41991",
"notes": [
{
"category": "description",
"text": "Django vulnerable to denial-of-service attack"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-r836-hh6v-rg5g",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-41991"
}
]
},
{
"cve": "CVE-2024-42005",
"notes": [
{
"category": "description",
"text": "Django SQL injection vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-pv4p-cwwg-4rph",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-42005"
}
]
},
{
"cve": "CVE-2024-4340",
"notes": [
{
"category": "description",
"text": "sqlparse parsing heavily nested list leads to Denial of Service"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.5.0 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-2m57-hf25-phgg",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-4340"
}
]
},
{
"cve": "CVE-2024-45230",
"notes": [
{
"category": "description",
"text": "Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5hgc-2vfp-mqvc",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-45230"
}
]
},
{
"cve": "CVE-2024-45231",
"notes": [
{
"category": "description",
"text": "Django allows enumeration of user e-mail addresses"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-rrqc-c2jx-6jgv",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-45231"
}
]
},
{
"cve": "CVE-2024-47081",
"notes": [
{
"category": "description",
"text": "Requests vulnerable to .netrc credentials leak via malicious URLs"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0012",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.32.4 or later.",
"product_ids": [
"CSAFPID-0012",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0012",
"CSAFPID-0017"
]
}
],
"title": "GHSA-9hjg-9r4m-mvj7",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-47081"
}
]
},
{
"cve": "CVE-2024-52304",
"notes": [
{
"category": "description",
"text": "aiohttp allows request smuggling due to incorrect parsing of chunk extensions"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.10.11 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8495-4g3g-x7pr",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-52304"
}
]
},
{
"cve": "CVE-2024-53907",
"notes": [
{
"category": "description",
"text": "Django denial-of-service in django.utils.html.strip_tags()"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.17 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8498-2h75-472j",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-53907"
}
]
},
{
"cve": "CVE-2024-53908",
"notes": [
{
"category": "description",
"text": "Django SQL injection in HasKey(lhs, rhs) on Oracle"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.17 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-m9g8-fxxm-xg86",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-53908"
}
]
},
{
"cve": "CVE-2024-56374",
"notes": [
{
"category": "description",
"text": "Django has a potential denial-of-service vulnerability in IPv6 validation"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.18 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-qcgg-j2x8-h9g8",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2024-56374"
}
]
},
{
"cve": "CVE-2025-13372",
"notes": [
{
"category": "description",
"text": "Django is vulnerable to SQL injection in column aliases"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.27 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-rqw2-ghq9-44m7",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-13372"
}
]
},
{
"cve": "CVE-2025-13473",
"notes": [
{
"category": "description",
"text": "Django has Observable Timing Discrepancy"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.28 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-2mcm-79hx-8fxw",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-13473"
}
]
},
{
"cve": "CVE-2025-14550",
"notes": [
{
"category": "description",
"text": "Django has Inefficient Algorithmic Complexity"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.28 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-33mw-q7rj-mjwj",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-14550"
}
]
},
{
"cve": "CVE-2025-26699",
"notes": [
{
"category": "description",
"text": "Django vulnerable to Allocation of Resources Without Limits or Throttling"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.20 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-p3fp-8748-vqfq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-26699"
}
]
},
{
"cve": "CVE-2025-32873",
"notes": [
{
"category": "description",
"text": "Django has a denial-of-service possibility in strip_tags()"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.21 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8j24-cjrq-gr2m",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-32873"
}
]
},
{
"cve": "CVE-2025-48432",
"notes": [
{
"category": "description",
"text": "Django Improper Output Neutralization for Logs vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.22 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-7xr5-9hcq-chf9",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-48432"
}
]
},
{
"cve": "CVE-2025-50181",
"notes": [
{
"category": "description",
"text": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.5.0 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-pq67-6m6q-mj2v",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-50181"
}
]
},
{
"cve": "CVE-2025-53643",
"notes": [
{
"category": "description",
"text": "AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.12.14 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-9548-qrrj-x5pj",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-53643"
}
]
},
{
"cve": "CVE-2025-57833",
"notes": [
{
"category": "description",
"text": "Django is subject to SQL injection through its column aliases"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.24 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-6w2r-r2m5-xq5w",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-57833"
}
]
},
{
"cve": "CVE-2025-59681",
"notes": [
{
"category": "description",
"text": "Django vulnerable to SQL injection in column aliases"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.25 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-hpr9-3m2g-3j9p",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-59681"
}
]
},
{
"cve": "CVE-2025-59682",
"notes": [
{
"category": "description",
"text": "Django vulnerable to partial directory traversal via archives"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.25 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-q95w-c7qg-hrff",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-59682"
}
]
},
{
"cve": "CVE-2025-64458",
"notes": [
{
"category": "description",
"text": "Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.26 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-qw25-v68c-qjf3",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-64458"
}
]
},
{
"cve": "CVE-2025-64459",
"notes": [
{
"category": "description",
"text": "Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.26 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-frmv-pr5f-9mcr",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-64459"
}
]
},
{
"cve": "CVE-2025-64460",
"notes": [
{
"category": "description",
"text": "Django is vulnerable to DoS via XML serializer text extraction"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.27 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-vrcr-9hj9-jcg6",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-64460"
}
]
},
{
"cve": "CVE-2025-66418",
"notes": [
{
"category": "description",
"text": "urllib3 allows an unbounded number of links in the decompression chain"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.6.0 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-gm62-xv2j-4w53",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-66418"
}
]
},
{
"cve": "CVE-2025-66471",
"notes": [
{
"category": "description",
"text": "urllib3 streaming API improperly handles highly compressed data"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.6.0 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-2xpw-w6gg-jr37",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-66471"
}
]
},
{
"cve": "CVE-2025-69223",
"notes": [
{
"category": "description",
"text": "AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-6mq8-rvhq-8wgg",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69223"
}
]
},
{
"cve": "CVE-2025-69224",
"notes": [
{
"category": "description",
"text": "AIOHTTP's unicode processing of header values could cause parsing discrepancies"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-69f9-5gxw-wvc2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69224"
}
]
},
{
"cve": "CVE-2025-69225",
"notes": [
{
"category": "description",
"text": "AIOHTTP has unicode match groups in regexes for ASCII protocol elements"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mqqc-3gqh-h2x8",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69225"
}
]
},
{
"cve": "CVE-2025-69226",
"notes": [
{
"category": "description",
"text": "AIOHTTP vulnerable to brute-force leak of internal static file path components"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-54jq-c3m8-4m76",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69226"
}
]
},
{
"cve": "CVE-2025-69227",
"notes": [
{
"category": "description",
"text": "AIOHTTP vulnerable to DoS when bypassing asserts"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-jj3x-wxrx-4x23",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69227"
}
]
},
{
"cve": "CVE-2025-69228",
"notes": [
{
"category": "description",
"text": "AIOHTTP vulnerable to denial of service through large payloads"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-6jhg-hg63-jvvf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69228"
}
]
},
{
"cve": "CVE-2025-69229",
"notes": [
{
"category": "description",
"text": "AIOHTTP vulnerable to DoS through chunked messages"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-g84x-mcqj-x9qq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69229"
}
]
},
{
"cve": "CVE-2025-69230",
"notes": [
{
"category": "description",
"text": "AIOHTTP Vulnerable to Cookie Parser Warning Storm"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-fh55-r93g-j68g",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69230"
}
]
},
{
"cve": "CVE-2025-69534",
"notes": [
{
"category": "description",
"text": "Python-Markdown has an Uncaught Exception"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0010",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.8.1 or later.",
"product_ids": [
"CSAFPID-0010",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0010",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5wmx-573v-2qwq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2025-69534"
}
]
},
{
"cve": "CVE-2026-1207",
"notes": [
{
"category": "description",
"text": "Django has an SQL Injection issue"
},
{
"category": "other",
"text": "A public nuclei exploit template exists (severity: high).",
"title": "Nuclei template"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.28 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mwm9-4648-f68q",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-1207"
}
]
},
{
"cve": "CVE-2026-1285",
"notes": [
{
"category": "description",
"text": "Django has Inefficient Algorithmic Complexity"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.28 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-4rrr-2h4v-f3j9",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-1285"
}
]
},
{
"cve": "CVE-2026-1287",
"notes": [
{
"category": "description",
"text": "Django has an SQL Injection issue"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.28 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-gvg8-93h5-g6qq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-1287"
}
]
},
{
"cve": "CVE-2026-1312",
"notes": [
{
"category": "description",
"text": "Django has an SQL Injection issue"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.28 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-6426-9fv3-65x8",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-1312"
}
]
},
{
"cve": "CVE-2026-15307",
"notes": [
{
"category": "description",
"text": "Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.17 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-wvqv-fj8w-qmhm",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-15307"
}
]
},
{
"cve": "CVE-2026-15830",
"notes": [
{
"category": "description",
"text": "Django GeoDjango vulnerable to denial of service through deeply nested geometry collections"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.17 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-q238-5cxm-5c9h",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-15830"
}
]
},
{
"cve": "CVE-2026-21441",
"notes": [
{
"category": "description",
"text": "Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.6.3 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-38jv-5279-wg99",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-21441"
}
]
},
{
"cve": "CVE-2026-22815",
"notes": [
{
"category": "description",
"text": "aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-w2fm-2cpv-w7v5",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-22815"
}
]
},
{
"cve": "CVE-2026-25645",
"notes": [
{
"category": "description",
"text": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0012",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.33.0 or later.",
"product_ids": [
"CSAFPID-0012",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0012",
"CSAFPID-0017"
]
}
],
"title": "GHSA-gc5v-m9x4-r6x2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-25645"
}
]
},
{
"cve": "CVE-2026-25673",
"notes": [
{
"category": "description",
"text": "Django vulnerable to Uncontrolled Resource Consumption"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.29 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8p8v-wh79-9r56",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-25673"
}
]
},
{
"cve": "CVE-2026-25674",
"notes": [
{
"category": "description",
"text": "Django has a Race Condition vulnerability"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.29 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mjgh-79qc-68w3",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-25674"
}
]
},
{
"cve": "CVE-2026-26007",
"notes": [
{
"category": "description",
"text": "cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 46.0.5 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-r6ph-v2qm-q3c2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-26007"
}
]
},
{
"cve": "CVE-2026-27448",
"notes": [
{
"category": "description",
"text": "pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 26.0.0 or later.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0007",
"CSAFPID-0017"
]
}
],
"title": "GHSA-vp96-hxj8-p424",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-27448"
}
]
},
{
"cve": "CVE-2026-27459",
"notes": [
{
"category": "description",
"text": "pyOpenSSL DTLS cookie callback buffer overflow"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0007",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 26.0.0 or later.",
"product_ids": [
"CSAFPID-0007",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0007",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5pwr-322w-8jr4",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-27459"
}
]
},
{
"cve": "CVE-2026-31900",
"notes": [
{
"category": "description",
"text": "Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct URL reference to a malicious repository. This could lead to arbitrary code execution in the context of the GitHub Action. Attackers could then gain access to secrets or permissions available in the context of the action. Version 26.3.0 fixes this vulnerability."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0013",
"CSAFPID-0017"
]
},
"title": "PYSEC-2026-2120",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-31900"
}
]
},
{
"cve": "CVE-2026-32274",
"notes": [
{
"category": "description",
"text": "Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0013",
"CSAFPID-0017"
]
},
"title": "PYSEC-2026-2121",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-32274"
}
]
},
{
"cve": "CVE-2026-33033",
"notes": [
{
"category": "description",
"text": "Django has potential DoS via MultiPartParser through crafted multipart uploads"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.30 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5mf9-h53q-7mhq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-33033"
}
]
},
{
"cve": "CVE-2026-33034",
"notes": [
{
"category": "description",
"text": "Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.30 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-933h-hp56-hf7m",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-33034"
}
]
},
{
"cve": "CVE-2026-34073",
"notes": [
{
"category": "description",
"text": "cryptography has incomplete DNS name constraint enforcement on peer names"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 46.0.6 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-m959-cc7f-wv43",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34073"
}
]
},
{
"cve": "CVE-2026-34513",
"notes": [
{
"category": "description",
"text": "AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-hcc4-c3v8-rx92",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34513"
}
]
},
{
"cve": "CVE-2026-34514",
"notes": [
{
"category": "description",
"text": "AIOHTTP has CRLF injection through multipart part content type header construction"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-2vrm-gr82-f7m5",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34514"
}
]
},
{
"cve": "CVE-2026-34515",
"notes": [
{
"category": "description",
"text": "AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-p998-jp59-783m",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34515"
}
]
},
{
"cve": "CVE-2026-34516",
"notes": [
{
"category": "description",
"text": "AIOHTTP has a Multipart Header Size Bypass"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-m5qp-6w8w-w647",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34516"
}
]
},
{
"cve": "CVE-2026-34517",
"notes": [
{
"category": "description",
"text": "AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-3wq7-rqq7-wx6j",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34517"
}
]
},
{
"cve": "CVE-2026-34518",
"notes": [
{
"category": "description",
"text": "AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-966j-vmvw-g2g9",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34518"
}
]
},
{
"cve": "CVE-2026-34519",
"notes": [
{
"category": "description",
"text": "AIOHTTP has HTTP response splitting via \\r in reason phrase"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mwh4-6h8g-pg8w",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34519"
}
]
},
{
"cve": "CVE-2026-34520",
"notes": [
{
"category": "description",
"text": "AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-63hf-3vf5-4wqf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34520"
}
]
},
{
"cve": "CVE-2026-34525",
"notes": [
{
"category": "description",
"text": "AIOHTTP accepts duplicate Host headers"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.13.4 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-c427-h43c-vf67",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34525"
}
]
},
{
"cve": "CVE-2026-34993",
"notes": [
{
"category": "description",
"text": "AIOHTTP is Vulnerable to Deserialization of Untrusted Data"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.0 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-jg22-mg44-37j8",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-34993"
}
]
},
{
"cve": "CVE-2026-3902",
"notes": [
{
"category": "description",
"text": "Django vulnerable to ASGI header spoofing via underscore/hyphen conflation"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.30 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mvfq-ggxm-9mc5",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-3902"
}
]
},
{
"cve": "CVE-2026-4277",
"notes": [
{
"category": "description",
"text": "Django vulnerable to privilege abuse in GenericInlineModelAdmin"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.30 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-pwjp-ccjc-ghwg",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-4277"
}
]
},
{
"cve": "CVE-2026-4292",
"notes": [
{
"category": "description",
"text": "Django vulnerable to privilege abuse in ModelAdmin.list_editable"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 4.2.30 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 2.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mmwr-2jhp-mc7j",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-4292"
}
]
},
{
"cve": "CVE-2026-44431",
"notes": [
{
"category": "description",
"text": "urllib3: Sensitive headers forwarded across origins in proxied low-level redirects"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.7.0 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-qccp-gfcp-xxvc",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-44431"
}
]
},
{
"cve": "CVE-2026-4539",
"notes": [
{
"category": "description",
"text": "Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0015",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.20.0 or later.",
"product_ids": [
"CSAFPID-0015",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 3.3,
"baseSeverity": "LOW",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0015",
"CSAFPID-0017"
]
}
],
"title": "GHSA-5239-wwwm-4pmq",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-4539"
}
]
},
{
"cve": "CVE-2026-45409",
"notes": [
{
"category": "description",
"text": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0011",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.15 or later.",
"product_ids": [
"CSAFPID-0011",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0011",
"CSAFPID-0017"
]
}
],
"title": "GHSA-65pc-fj4g-8rjx",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-45409"
}
]
},
{
"cve": "CVE-2026-47265",
"notes": [
{
"category": "description",
"text": "AIOHTTP is vulnerable to cross-origin redirect with per-request cookies"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.0 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-hg6j-4rv6-33pg",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-47265"
}
]
},
{
"cve": "CVE-2026-48587",
"notes": [
{
"category": "description",
"text": "Django: has_vary_header may expose cached responses when Vary values contain whitespace"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-923m-gv2p-w5qp",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-48587"
}
]
},
{
"cve": "CVE-2026-48588",
"notes": [
{
"category": "description",
"text": "Django: cache middleware may expose private responses when unrelated request cookies are present"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-3h9f-r86x-qvjx",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-48588"
}
]
},
{
"cve": "CVE-2026-50269",
"notes": [
{
"category": "description",
"text": "aiohttp: CRLF injection in multipart headers"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.0 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-m6qw-4cw2-hm4m",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-50269"
}
]
},
{
"cve": "CVE-2026-53877",
"notes": [
{
"category": "description",
"text": "Django: GDALRaster may over-read heap memory when constructed from bytes"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-crhf-3pfg-w68w",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-53877"
}
]
},
{
"cve": "CVE-2026-53878",
"notes": [
{
"category": "description",
"text": "Django: DomainNameValidator permits newline characters that may enable HTTP header injection"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.16 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8qcx-xf44-272x",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-53878"
}
]
},
{
"cve": "CVE-2026-54273",
"notes": [
{
"category": "description",
"text": "aiohttp: HTTP/1 Pipelined Requests Queue Without Limit"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-4fvr-rgm6-gqmc",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54273"
}
]
},
{
"cve": "CVE-2026-54274",
"notes": [
{
"category": "description",
"text": "aiohttp: Incomplete websocket frame payloads bypass memory limits"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-xcgm-r5h9-7989",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54274"
}
]
},
{
"cve": "CVE-2026-54275",
"notes": [
{
"category": "description",
"text": "aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-4m7w-qmgq-4wj5",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54275"
}
]
},
{
"cve": "CVE-2026-54276",
"notes": [
{
"category": "description",
"text": "aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-hpj7-wq8m-9hgp",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54276"
}
]
},
{
"cve": "CVE-2026-54277",
"notes": [
{
"category": "description",
"text": "aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-63hw-fmq6-xxg2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54277"
}
]
},
{
"cve": "CVE-2026-54278",
"notes": [
{
"category": "description",
"text": "aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-g3cq-j2xw-wf74",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54278"
}
]
},
{
"cve": "CVE-2026-54279",
"notes": [
{
"category": "description",
"text": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-2fqr-mr3j-6wp8",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54279"
}
]
},
{
"cve": "CVE-2026-54280",
"notes": [
{
"category": "description",
"text": "aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.1 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-9x8q-7h8h-wcw9",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54280"
}
]
},
{
"cve": "CVE-2026-54284",
"notes": [
{
"category": "description",
"text": "sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-pwgv-4x5q-6m9f",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-54284"
}
]
},
{
"cve": "CVE-2026-59881",
"notes": [
{
"category": "description",
"text": "AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.2 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mq44-7p77-q5h7",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-59881"
}
]
},
{
"cve": "CVE-2026-59893",
"notes": [
{
"category": "description",
"text": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-prg7-hcfm-mfcr",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-59893"
}
]
},
{
"cve": "CVE-2026-59894",
"notes": [
{
"category": "description",
"text": "sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-3496-9g83-7v6x",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-59894"
}
]
},
{
"cve": "CVE-2026-6873",
"notes": [
{
"category": "description",
"text": "Django: signed cookies are vulnerable to salt namespace collisions"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-h7pc-vwp9-298g",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-6873"
}
]
},
{
"cve": "CVE-2026-69243",
"notes": [
{
"category": "description",
"text": "AIOHTTP: HTTP request smuggling via WebSocket upgrade"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.2 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-mfx4-hv73-q22v",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-69243"
}
]
},
{
"cve": "CVE-2026-69244",
"notes": [
{
"category": "description",
"text": "AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0006",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.14.3 or later.",
"product_ids": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0006",
"CSAFPID-0017"
]
}
],
"title": "GHSA-cq5v-8q36-5273",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-69244"
}
]
},
{
"cve": "CVE-2026-69248",
"notes": [
{
"category": "description",
"text": "cryptography is a package designed to expose cryptographic primitives ..."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 49.0.0 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "CVE-2026-69248",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-69248"
}
]
},
{
"cve": "CVE-2026-69249",
"notes": [
{
"category": "description",
"text": "python-cryptography is a package designed to expose cryptographic prim ..."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 49.0.0 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "CVE-2026-69249",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-69249"
}
]
},
{
"cve": "CVE-2026-71491",
"notes": [
{
"category": "description",
"text": "sqlparse: Quadratic O(n²) DoS in group_comments"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-f2ff-p2ww-7p4p",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-71491"
}
]
},
{
"cve": "CVE-2026-73228",
"notes": [
{
"category": "description",
"text": "Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0009",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.17.2 or later.",
"product_ids": [
"CSAFPID-0009",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
}
},
"products": [
"CSAFPID-0009",
"CSAFPID-0017"
]
}
],
"title": "GHSA-2m8g-3cmr-wg3w",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-73228"
}
]
},
{
"cve": "CVE-2026-73229",
"notes": [
{
"category": "description",
"text": "Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0009",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 3.17.2 or later.",
"product_ids": [
"CSAFPID-0009",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0009",
"CSAFPID-0017"
]
}
],
"title": "GHSA-g47c-3xmw-q6m2",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-73229"
}
]
},
{
"cve": "CVE-2026-8404",
"notes": [
{
"category": "description",
"text": "Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 5.2.15 or later.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8cjm-8mp7-r2xf",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-8404"
}
]
},
{
"cve": "CVE-2026-84305",
"notes": [
{
"category": "description",
"text": "sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.6.0 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-cfqr-cjx5-5jcm",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-84305"
}
]
},
{
"cve": "CVE-2026-97687",
"notes": [
{
"category": "description",
"text": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.8.0 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-8988-9cw3-xx77",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-97687"
}
]
},
{
"cve": "CVE-2026-97689",
"notes": [
{
"category": "description",
"text": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0004",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 2.8.0 or later.",
"product_ids": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0004",
"CSAFPID-0017"
]
}
],
"title": "GHSA-vxq7-64xx-v4gw",
"references": [
{
"category": "external",
"summary": "EPSS / KEV / nuclei enrichment source",
"url": "https://vulnlookup.ndaal.eu:443/api/v1/vulnerability/CVE-2026-97689"
}
]
},
{
"notes": [
{
"category": "description",
"text": "sqlparse: formatting list of tuples leads to denial of service"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0003",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 0.5.4 or later.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0003",
"CSAFPID-0017"
]
}
],
"title": "GHSA-27jp-wm6q-gp25"
},
{
"notes": [
{
"category": "description",
"text": "Vulnerable OpenSSL included in cryptography wheels"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 48.0.1 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
}
},
"products": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-537c-gmf6-5ccf"
},
{
"notes": [
{
"category": "description",
"text": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0017"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to 43.0.1 or later.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0017"
]
}
],
"title": "GHSA-h4gh-qq45-vh27"
},
{
"notes": [
{
"category": "description",
"text": "GHSA-5h86-8mv2-jq9f (HIGH) affects pkg:pypi/aiohttp@3.8.6. Review the advisory and update or pin a patched version."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0017"
]
},
"title": "bomdrift.cve"
},
{
"notes": [
{
"category": "description",
"text": "`click-plugins` is deprecated upstream: PyPI classifier: Development Status :: 7 - Inactive"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0018"
]
},
"title": "bomdrift.deprecated"
}
]
}