CVE-2026-1287
published 2026-02-03CVE-2026-1287: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via…
PriorityP338medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.86%
58.0th percentile
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-django | < python-django 3:3.2.25-0+deb12u2 (bookworm) | python-django 3:3.2.25-0+deb12u2 (bookworm) |
| djangoproject | django | >= 4.2 < 4.2.28 | 4.2.28 |
| djangoproject | django | >= 4.2a1 < 4.2.28 | 4.2.28 |
| djangoproject | django | >= 5.2 < 5.2.11 | 5.2.11 |
| djangoproject | django | >= 5.2a1 < 5.2.11 | 5.2.11 |
| djangoproject | django | >= 6.0 < 6.0.2 | 6.0.2 |
| djangoproject | django | >= 6.0a1 < 6.0.2 | 6.0.2 |
| fastify | fastify | >= 5.3.2 < 5.8.5 | 5.8.5 |
| github.com | mattermost_mattermost-server | >= 0 < 5.3.2-0.20260129181235-1346cf529aef | 5.3.2-0.20260129181235-1346cf529aef |
| github.com | mattermost_mattermost-server | >= 10.11.0-rc1 < 10.11.11 | 10.11.11 |
| github.com | mattermost_mattermost-server | >= 11.2.0-rc1 < 11.2.3 | 11.2.3 |
| github.com | mattermost_mattermost-server | >= 11.3.0-rc1 < 11.3.1 | 11.3.1 |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20260129181235-1346cf529aef | 8.0.0-20260129181235-1346cf529aef |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2022_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2025_for_x64-based_systems | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_21h2 | — | — |
| msrc | windows_10_version_22h2 | — | — |
| msrc | windows_11_version_23h2 | — | — |
| msrc | windows_11_version_24h2 | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
ghsa7.5HIGH
osv5.4MEDIUM
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
vendor_debian5.4MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
ghsa·2026-07-02
CVE-2026-2092 [HIGH] CWE-1287 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
VulDB
Django up to 4.2.27/5.2.10/6.0.1 annotate/aggregate/extra/values/values_list/alias sql injection (Nessus ID 297742 / WID-SEC-2026-0297)
vuldb·2026-07-01·CVSS 5.4
CVE-2026-1287 [MEDIUM] Django up to 4.2.27/5.2.10/6.0.1 annotate/aggregate/extra/values/values_list/alias sql injection (Nessus ID 297742 / WID-SEC-2026-0297)
A vulnerability was found in Django up to 4.2.27/5.2.10/6.0.1. It has been rated as critical. The affected element is the function annotate/aggregate/extra/values/values_list/alias. This manipulation causes sql injection.
This vulnerability is tracked as CVE-2026-1287. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
ghsa·2026-04-15·CVSS 7.5
CVE-2026-33806 [HIGH] CWE-1287 Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header
### Summary
A validation bypass vulnerability exists in Fastify v5.x where request body validation schemas specified via `schema.body.content` can be completely circumvented by prepending a single space character (`\x20`) to the `Content-Type` header. The body is still parsed correctly as JSON (or any other content type), but schema validation is entirely skipped.
This is a regression introduced by commit [`f3d2bcb`](https://github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4) (fix for [CVE-2025-32442](https://github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc)).
### Details
The vulnerability is a **parser-validator differential** between two independent code paths
GHSA
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
ghsa·2026-03-18
CVE-2026-2092 [HIGH] CWE-1287 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GHSA
Mattermost fails to properly validate User-Agent header tokens
ghsa·2026-03-16
CVE-2026-25783 [MEDIUM] CWE-1287 Mattermost fails to properly validate User-Agent header tokens
Mattermost fails to properly validate User-Agent header tokens
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
GHSA
Django has an SQL Injection issue
ghsa·2026-02-03
CVE-2026-1287 [HIGH] CWE-89 Django has an SQL Injection issue
Django has an SQL Injection issue
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.
OSV
python-django vulnerabilities
osv·2026-02-03·CVSS 5.3
CVE-2025-13473 [MEDIUM] python-django vulnerabilities
python-django vulnerabilities
It was discovered that Django exposed timing information when checking
passwords. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2025-13473)
Jiyong Yang discovered that Django incorrectly handled malformed requests
with duplicate headers. An attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 25.10. (CVE-2025-14550)
Tarek Nakkouch discovered that Django incorrectly parsed raster lookups. An
attacker could possibly use this issue to perform SQL injection attacks.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-1207)
Seokchan Yoon discovered that Django incorrect
OSV
CVE-2026-1287: An issue was discovered in 6
osv·2026-02-03·CVSS 5.4
CVE-2026-1287 [MEDIUM] CVE-2026-1287: An issue was discovered in 6
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.
OSV
Django has an SQL Injection issue
osv·2026-02-03
CVE-2026-1287 [HIGH] Django has an SQL Injection issue
Django has an SQL Injection issue
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.
Red Hat
kernel: wifi: mac80211: disconnect on CSA to channel 0
vendor_redhat·2026-09-17·CVSS 5.5
CVE-2026-90344 [MEDIUM] CWE-1287 kernel: wifi: mac80211: disconnect on CSA to channel 0
kernel: wifi: mac80211: disconnect on CSA to channel 0
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: disconnect on CSA to channel 0
The refactor for the CSA parsing erroneously equates channel
zero and no information present, leading it to ignore a CSA
on an AP that advertises a switch to that (invalid) channel.
This leads to not disconnecting, which we should. For Intel
devices, this can lead to a firmware crash.
Fix this by using an int type for the channel number as well
as the opclass, and using a (negative) value that cannot be
encoded in the element to indicate it's not present.
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A remote attacker, operating a malicious Access Point (AP), could exploit this by sending a Channel
Red Hat
kernel: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
vendor_redhat·2026-08-15·CVSS 8.8
CVE-2026-72294 [HIGH] CWE-1287 kernel: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
kernel: LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt()
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) component, specifically within the LoongArch architecture. The `kvm_vcpu_ioctl_interrupt()` function, which can be invoked from userspace, lacks proper validation of interrupt requests. This missing validity check could allow a local attacker to trigger an invalid interrupt, potentially leading to a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Re
Red Hat
kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63840 [HIGH] CWE-1287 kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring
JPEG rings do not support 64-bit user fence writes, reject CS
submissions with user fences.
(cherry picked from commit 86ac011ae234c03fb872f4945913391ea1d8862e)
A flaw was found in the Linux kernel's drm/amdgpu/jpeg driver. The JPEG v5.3.0 ring within this driver does not support 64-bit user fence writes. A local user or application attempting to submit commands with 64-bit user fences to the amdgpu JPEG v5.3.0 ring will have these submissions rejected. This can lead to a denial of service for operations that rely on this specific functionality.
Package: kernel (Red Hat Enterprise Linux 10) - Not affec
Red Hat
kernel: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63849 [HIGH] CWE-1287 kernel: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
kernel: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring
VCN encoder and decoder rings do not support 64-bit user fence writes,
reject CS submissions with user fences.
(cherry picked from commit e16be95a2c3ee712b142cb27d2dca0b461181359)
A flaw was found in the Linux kernel's AMD GPU (Graphics Processing Unit) Video Core Next (VCN) component. This vulnerability arises because the VCN encoder and decoder rings do not properly support 64-bit user fence writes. A local attacker could potentially exploit this by submitting command streams (CS) with user fences, leading to the rejection of these submissions. This could result in a denial of service, preventing
Red Hat
kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63852 [HIGH] CWE-1287 kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
kernel: drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring
VCN encoder and decoder rings do not support 64-bit user fence writes,
reject CS submissions with user fences.
(cherry picked from commit ff1a5a125c5a70c328806b9bc01d7d942cf3f9aa)
A flaw was found in the Linux kernel's AMD GPU (Graphics Processing Unit) Video Core Next (VCN) component. This vulnerability arises because the VCN encoder and decoder rings do not properly handle 64-bit user fence writes, leading to the rejection of command submissions that utilize these fences. An attacker could potentially exploit this to cause a denial of service by preventing legitimate operations that rely on 64-bit
Red Hat
kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63847 [HIGH] CWE-1287 kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring
JPEG rings do not support 64-bit user fence writes, reject CS
submissions with user fences.
(cherry picked from commit 3216a7f4e2642bda5fd14f57586e835ae9202587)
A flaw was found in the Linux kernel's AMD GPU JPEG driver. This issue occurs because the JPEG hardware component does not properly handle certain types of graphics commands, specifically 64-bit user fence writes. An attacker could craft and submit malicious commands, causing the system to reject these submissions. This could lead to a denial of service, making the graphics functionality unavailable.
Package: kernel (Red Hat Enterprise Linux 10) -
Red Hat
kernel: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63850 [HIGH] CWE-1287 kernel: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
kernel: drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring
VCN encoder and decoder rings do not support 64-bit user fence writes,
reject CS submissions with user fences.
(cherry picked from commit 49b1fbbb5a071197ee71e2d70959b1cb29bdc317)
A flaw was found in the Linux kernel's AMDGPU Video Core Next (VCN) component. The VCN encoder and decoder rings, specifically version 5.0.0, do not correctly support 64-bit user fence writes. This can lead to a denial of service, as the kernel will reject command submissions that attempt to use these unsupported user fences, preventing affected applications from utilizing the VCN functionality as intended.
Package: kerne
Red Hat
kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
vendor_redhat·2026-07-19·CVSS 7.8
CVE-2026-63845 [HIGH] CWE-1287 kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
kernel: drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
JPEG rings do not support 64-bit user fence writes, reject CS
submissions with user fences.
(cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a)
A flaw was found in the Linux kernel, specifically within the AMD GPU's JPEG (Joint Photographic Experts Group) ring component. This vulnerability occurs because the JPEG v4.0 rings do not support 64-bit user fence writes. This can lead to the system rejecting command submissions that utilize user fences, potentially causing a denial of service for applications relying on this functionality.
Package: kernel (Red Hat Enterprise Linux 10) - Not affec
Red Hat
dotnet: .NET Framework: Denial of Service via improper input validation
vendor_redhat·2026-07-14·CVSS 7.5
CVE-2026-50524 [HIGH] CWE-1287 dotnet: .NET Framework: Denial of Service via improper input validation
dotnet: .NET Framework: Denial of Service via improper input validation
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users.
Package: dotnet10.0 (Red Hat Enterprise Linux 10) - Affected
Package: dotnet8.0 (Red Hat Enterprise Linux 10) - Affected
Package: dotnet9.0 (Red Hat Enterprise Linux 10) - Affected
Package: dotnet10.0 (Red Hat Enterprise Linux 8) - Affected
Package: dotnet8.0 (Red Hat Enterprise Linux 8) - Affected
Package: dotnet9.0 (
Red Hat
vllm: vLLM: Denial of Service due to improper floating-point validation
vendor_redhat·2026-06-22·CVSS 6.5
CVE-2026-54235 [MEDIUM] CWE-1287 vllm: vLLM: Denial of Service due to improper floating-point validation
vllm: vLLM: Denial of Service due to improper floating-point validation
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). The temperature validation gates, which use comparison operators, incorrectly handle Not-a-Number (NaN) and positive Infinity values in Python's IEEE 754 float semantics. The
Red Hat
kernel: net: usb: catc: enable basic endpoint checking
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-45923 [LOW] CWE-1287 kernel: net: usb: catc: enable basic endpoint checking
kernel: net: usb: catc: enable basic endpoint checking
A flaw was found in the Linux kernel's `net: usb: catc` driver. A malformed Universal Serial Bus (USB) device can present endpoint descriptors with transfer types that differ from what the driver expects. This can lead to the driver attempting to use incorrect endpoint types, potentially causing unexpected behavior or resource exhaustion within the kernel. The vulnerability is resolved by adding checks to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 7)
Red Hat
kernel: net: usb: pegasus: enable basic endpoint checking
vendor_redhat·2026-05-06·CVSS 7.0
CVE-2026-43156 [MEDIUM] CWE-1287 kernel: net: usb: pegasus: enable basic endpoint checking
kernel: net: usb: pegasus: enable basic endpoint checking
A flaw was found in the Linux kernel's USB Pegasus driver. This vulnerability allows a local attacker to use a specially crafted USB device to bypass expected endpoint checks. By presenting unexpected transfer types, the malicious device could trigger a system assertion, potentially leading to a denial of service (DoS) condition.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package: kernel (Red Hat Enterprise Linux 9) -
Red Hat
kernel: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
vendor_redhat·2026-05-06
CVE-2026-43243 CWE-1287 kernel: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
kernel: drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
A flaw was found in the `drm/amd/display` component of the Linux kernel. A missing signal type check in the `dcn401 get_phyd32clk_src` function, when attempting to access link encoder (`link enc`) on a DisplayPort Interoperability and Compliance Association (DPIA) link, can lead to a system crash. This vulnerability could result in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - No
Red Hat
kernel: minix: Add required sanity checking to minix_check_superblock()
vendor_redhat·2026-05-06·CVSS 7.0
CVE-2026-43209 [MEDIUM] CWE-1287 kernel: minix: Add required sanity checking to minix_check_superblock()
kernel: minix: Add required sanity checking to minix_check_superblock()
A flaw was found in the Linux kernel's minix filesystem implementation. The `minix_check_superblock()` function lacks proper sanity checks for superblock fields, including `s_log_zone_size`. This oversight could allow a local attacker to craft a malicious minix filesystem that, when mounted, may lead to a system crash or corruption, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterp
Red Hat
kernel: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
vendor_redhat·2026-04-13·CVSS 5.5
CVE-2026-31424 [MEDIUM] CWE-1287 kernel: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
kernel: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
A flaw was found in the Linux kernel's netfilter subsystem, specifically within the x_tables and arptables components. This vulnerability arises when xt_match and xt_target extensions, registered for unspecified protocol families, are incorrectly processed by the Address Resolution Protocol (ARP) subsystem. An attacker could exploit this by crafting network packets that trigger a mismatch in hook validation, leading to a null pointer dereference and ultimately a kernel panic, resulting in a Denial of Service (DoS) for the affected system.
Statement: Incorrect extension registration for ARP chains is a correctness bug in the netfilter compatibility path. Exploitation for a panic requires a priv
Red Hat
kernel: ALSA: usb-audio: Use correct version for UAC3 header validation
vendor_redhat·2026-03-25·CVSS 6.6
CVE-2026-23318 [MEDIUM] CWE-1287 kernel: ALSA: usb-audio: Use correct version for UAC3 header validation
kernel: ALSA: usb-audio: Use correct version for UAC3 header validation
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Use correct version for UAC3 header validation
The entry of the validators table for UAC3 AC header descriptor is
defined with the wrong protocol version UAC_VERSION_2, while it should
have been UAC_VERSION_3. This results in the validator never matching
for actual UAC3 devices (protocol == UAC_VERSION_3), causing their
header descriptors to bypass validation entirely. A malicious USB
device presenting a truncated UAC3 header could exploit this to cause
out-of-bounds reads when the driver later accesses unvalidated
descriptor fields.
The bug was introduced in the same commit as the recently fixed UAC3
feature unit sub-type typo, and a
Microsoft
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
vendor_msrc·2026-03-10·CVSS 7.0
CVE-2026-25179 [HIGH] CWE-1287 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Description: Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
FAQ: What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.
Windows Ancillary Function Driver for WinSock: Windows Ancillary Function Driver for Win
Red Hat
keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
vendor_redhat·2026-03-05·CVSS 7.7
CVE-2026-2092 [HIGH] CWE-1287 keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can e
Red Hat
Django: Django: SQL Injection via crafted column aliases
vendor_redhat·2026-02-03·CVSS 5.4
CVE-2026-1287 [MEDIUM] CWE-89 Django: Django: SQL Injection via crafted column aliases
Django: Django: SQL Injection via crafted column aliases
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.
A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted ali
Ubuntu
Django vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 5.3
CVE-2026-1312 [MEDIUM] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
It was discovered that Django exposed timing information when checking
passwords. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2025-13473)
Jiyong Yang discovered that Django incorrectly handled malformed requests
with duplicate headers. An attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, and Ubuntu 25.10. (CVE-2025-14550)
Tarek Nakkouch discovered that Django incorrectly parsed raster lookups. An
attacker could possibly use this issue to perform SQL injection attacks.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-20
Debian
CVE-2026-1287: python-django - An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4...
vendor_debian·2026·CVSS 5.4
CVE-2026-1287 [MEDIUM] CVE-2026-1287: python-django - An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4...
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Solomon Kebede for reporting this issue.
Scope: local
bookworm: resolved (fixed in 3:3.2.25-0+deb12u2)
bullseye: resolved (fixed in 2:2.2.28-1~deb11u12)
forky: resolved (fixed in 3:4.2.28-1)
sid: resolved (fixed in 3:4.2.28-1)
trixie: resolved (fixed in 3:4.2.28-0+deb13u1)
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-14550 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-14550 [HIGH] CVE-2025-14550 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-14550 :
Django vulnerability analysis and mitigation
ASGIRequest
Source : NVD
## 7.5
Score
Published February 3, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 18.5
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
authentik
authentik-fips
Sources
NVD
Alpine 3.23 Severity HIGH Has Fix Added at: Feb 10, 2026
Alpine edge Severity HIGH Has Fix Added at: Feb 08, 2026
Chainguard Has Fix Added at: Feb 08, 2026
Debian 11 Severity HIGH No Fix Added at: Feb 04, 2026
Debian 12, 13, 14 Severity HIGH Has Fix Added at: Feb 04, 2026
Echo Severity HIGH Has Fix Added at: Feb 04, 2026
p
Wiz
CVE-2026-1207 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.4
CVE-2026-1207 [MEDIUM] CVE-2026-1207 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1207 :
Django vulnerability analysis and mitigation
RasterField
Source : NVD
## 5.4
Score
Published February 3, 2026
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Django
Chainguard
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 88.2
Exploitation Probability (EPSS) 3.8
Affected packages and libraries
py3-django
python3-django-bash-completion
Sources
NVD
Alpine 3.23 Severity MEDIUM Has Fix Added at: Feb 10, 2026
Alpine edge Severity MEDIUM Has Fix Added at: Feb 08, 2026
Chainguard Has Fix Added at: Feb 08, 2026
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 04, 2026
Echo Severity MEDIUM Has Fix Added at: Feb 04, 2026
pip Severity HIGH Has Fix
Wiz
CVE-2025-13473 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2025-13473 [MEDIUM] CVE-2025-13473 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-13473 :
Django vulnerability analysis and mitigation
django.contrib.auth.handlers.modwsgi.check_password()
mod_wsgi
Source : NVD
## 5.3
Score
Published February 3, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
authentik
authentik-fips
Sources
NVD
Alpine 3.23 Severity MEDIUM Has Fix Added at: Feb 10, 2026
Alpine edge Severity MEDIUM Has Fix Added at: Feb 08, 2026
Chainguard Has Fix Added at: Feb 08, 2026
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 04, 2026
Echo Severity MEDIUM Has Fix Added at: Feb 0
Wiz
CVE-2026-1285 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-1285 [HIGH] CVE-2026-1285 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1285 :
Django vulnerability analysis and mitigation
django.utils.text.Truncator.chars()
Truncator.words()
html=True
truncatechars_html
truncatewords_html
Source : NVD
## 7.5
Score
Published February 3, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 20
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
awx
python3-django-bash-completion
Sources
NVD
Alpine 3.23 Severity HIGH Has Fix Added at: Feb 10, 2026
Alpine edge Severity HIGH Has Fix Added at: Feb 08, 2026
Chainguard Has Fix Added at: Feb 08, 2026
Debian 11, 12, 13, 14 Severity HIGH Has Fix Added at: Feb 04, 2026
Ec
Wiz
CVE-2026-1287 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-1287 [HIGH] CVE-2026-1287 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1287 :
Django vulnerability analysis and mitigation
FilteredRelation
**kwargs
QuerySet
annotate()
aggregate()
extra()
values()
values_list()
alias()
Source : NVD
## 5.4
Score
Published February 3, 2026
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
label-studio
django
Sources
NVD
Alpine 3.23 Severity MEDIUM Has Fix Added at: Feb 10, 2026
Alpine edge Severity MEDIUM Has Fix Added at: Feb 08, 2026
Chainguard Has Fix Added at: Feb 08, 2026
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 04, 2026
Echo Seve
Wiz
CVE-2026-25673 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-25673 [HIGH] CVE-2026-25673 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25673 :
Django vulnerability analysis and mitigation
URLField.to_python()
urllib.parse.urlsplit()
Source : NVD
## 7.5
Score
Published March 3, 2026
Severity HIGH
CNA Score 7.5
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 45.7
Exploitation Probability (EPSS) 0.2
Affected packages and libraries
authentik-fips
awx
Sources
NVD
Alpine 3.23 Severity HIGH Has Fix Added at: Mar 08, 2026
Chainguard Has Fix Added at: Mar 08, 2026
pip Severity HIGH Has Fix Added at: Mar 05, 2026
MinimOS Severity HIGH Has Fix Added at: Mar 08, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on wha
Wiz
CVE-2026-25674 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-25674 [HIGH] CVE-2026-25674 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25674 :
Django vulnerability analysis and mitigation
umask
Source : NVD
## 3.7
Score
Published March 3, 2026
Severity LOW
CNA Score 3.7
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
py3-django
django
Sources
NVD
Alpine 3.23 Severity LOW Has Fix Added at: Mar 08, 2026
Chainguard Has Fix Added at: Mar 08, 2026
Debian 11, 12, 13 Severity MEDIUM No Fix Added at: Mar 03, 2026
Debian 14 Severity LOW Has Fix Added at: Mar 03, 2026
Echo Severity LOW No Fix Added at: Mar 03, 2026
pip Severity LOW Has Fix Added at: Mar 05, 2026
MinimOS Severity LOW Has Fix A
Wiz
CVE-2026-1312 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-1312 [HIGH] CVE-2026-1312 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1312 :
Django vulnerability analysis and mitigation
.QuerySet.order_by()
FilteredRelation
Source : NVD
## 5.4
Score
Published February 3, 2026
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Django
Chainguard
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 1.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
python3-django
python3-django-doc
Sources
NVD
Alpine 3.23 Severity MEDIUM Has Fix Added at: Feb 10, 2026
Alpine edge Severity MEDIUM Has Fix Added at: Feb 08, 2026
Chainguard Has Fix Added at: Feb 08, 2026
Debian 11, 12, 13, 14 Severity MEDIUM Has Fix Added at: Feb 04, 2026
Echo Severity MEDIUM Has Fix Added at: Feb 04, 2026
pip Seve
Bugzilla
CVE-2026-1287 python-django3: Django: SQL Injection via crafted column aliases [epel-8]
bugzilla·2026-02-04·CVSS 5.4
CVE-2026-1287 [MEDIUM] CVE-2026-1287 python-django3: Django: SQL Injection via crafted column aliases [epel-8]
CVE-2026-1287 python-django3: Django: SQL Injection via crafted column aliases [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Package `python-django3` is retired on the `epel8` dist-git branch (the `dead.package` marker is present); closing as CANTFIX since there's no live package to update.
Bugzilla
CVE-2026-1287 Django: Django: SQL Injection via crafted column aliases
bugzilla·2026-02-03·CVSS 5.4
CVE-2026-1287 [MEDIUM] CVE-2026-1287 Django: Django: SQL Injection via crafted column aliases
CVE-2026-1287 Django: Django: SQL Injection via crafted column aliases
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Solomon Kebede for reporting this issue.
Discussion:
This issue has been addressed in the following products:
Red Hat Ansible Automation Platform 2.6 for RHEL 9
Red Hat Ansible Automation Platform 2.6 for RHEL 10
https://docs.djangoproject.com/en/dev/releases/security/https://groups.google.com/g/django-announcehttps://www.djangoproject.com/weblog/2026/feb/03/security-releases/https://access.redhat.com/errata/RHSA-2026:14835https://access.redhat.com/errata/RHSA-2026:2694https://access.redhat.com/errata/RHSA-2026:3958https://access.redhat.com/errata/RHSA-2026:3959https://access.redhat.com/errata/RHSA-2026:3960https://access.redhat.com/errata/RHSA-2026:3962https://access.redhat.com/errata/RHSA-2026:5970https://access.redhat.com/errata/RHSA-2026:5971https://access.redhat.com/errata/RHSA-2026:6291https://access.redhat.com/security/cve/CVE-2026-1287https://bugzilla.redhat.com/show_bug.cgi?id=2436339https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1287.json
2026-02-03
Published