https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T01:46:59.877057+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-13372 CVE-2025-13372 — Potential SQL injection in FilteredRelation column aliases on PostgreSQL 2026-09-30T01:46:59.881456+00:00

Affected: djangoproject Django

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

 https://vulnerability.circl.lu/vuln/usn-7903-1 USN-7903-1 — python-django vulnerabilities 2026-09-30T01:46:59.881610+00:00

Affected: Ubuntu:Pro:14.04:LTS: python-django, Ubuntu:Pro:16.04:LTS: python-django, Ubuntu:Pro:18.04:LTS: python-django, Ubuntu:Pro:20.04:LTS: python-django, Ubuntu:22.04:LTS: python-django, Ubuntu:24.04:LTS: python-django, Ubuntu:25.10: python-django

It was discovered that Django incorrectly handled certain characters in the FilteredRelation object. An attacker could possibly use this issue to execute arbitrary SQL commands. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10. (CVE-2025-13372)

Seokchan Yoon discovered that Django inefficiently handled deserialization of XML objects. An attacker could possibly use this issue to cause Django to use excessive resources, causing a denial of service. (CVE-2025-64460)