[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2025-13473":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":78,"aliases":79,"duplicate_of":9,"upstream":92,"downstream":93,"duplicates":117,"related":118,"reserved_at":9,"published_at":128,"modified_at":129,"state":130,"summary":131,"references_raw":140,"kevs":206,"epss":207,"epss_history":210,"metrics":482,"affected":498},"CVE-2025-13473","An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nThe `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows remote attackers to enumerate users via a timing attack.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Stackered for reporting this issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-208","Observable Timing Discrepancy","Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.","weakness","Incomplete","Base",[19,23,35],{"id":20,"name":21,"techniques":22},"CAPEC-462","Cross-Domain Search Timing",[],{"id":24,"name":25,"techniques":26},"CAPEC-541","Application Fingerprinting",[27],{"id":28,"name":29,"tactics":30,"countermeasures":34},"T1592.002","Software",[31],{"id":32,"name":33},"TA0043","Reconnaissance",[],{"id":36,"name":37,"techniques":38},"CAPEC-580","System Footprinting",[39],{"id":40,"name":41,"tactics":42,"countermeasures":46},"T1082","System Information Discovery",[43],{"id":44,"name":45},"TA0102","Discovery",[47,52,57,61,66,70,74],{"id":48,"name":49,"tactic":50},"D3-DE","Decoy Environment",{"name":51},"Deceive",{"id":53,"name":54,"tactic":55},"D3-EAL","Executable Allowlisting",{"name":56},"Isolate",{"id":58,"name":59,"tactic":60},"D3-HBPI","Hardware-based Process Isolation",{"name":56},{"id":62,"name":63,"tactic":64},"D3-PSA","Process Spawn Analysis",{"name":65},"Detect",{"id":67,"name":68,"tactic":69},"D3-SCF","System Call Filtering",{"name":56},{"id":71,"name":72,"tactic":73},"D3-EDL","Executable Denylisting",{"name":56},{"id":75,"name":76,"tactic":77},"D3-SCA","System Call Analysis",{"name":65},[],[80,81,82,83,84,85,86,87,88,89,90,91],"GHSA-2mcm-79hx-8fxw","BIT-django-2025-13473","PYSEC-2026-42","DEBIAN-CVE-2025-13473","CGA-3q6r-5m9j-rc4r","CGA-53c5-jfpg-4373","CGA-78xx-jw2g-pmpq","CGA-7hwv-c32p-fv4r","CGA-7wwc-6gh5-j37w","CGA-8mvh-v77f-6cqg","CGA-c4f9-vpjc-57rx","CGA-v6fv-3g4w-cpp4",[],[94,96,98,100,102,104,106,108,110,112,114,115],{"_key":95},"OPENSUSE-SU-2026:10160-1",{"_key":97},"DLA-4484-1",{"_key":99},"DSA-6150-1",{"_key":101},"SUSE-SU-2026:0440-1",{"_key":103},"OPENSUSE-SU-2026:10145-1",{"_key":105},"OPENSUSE-SU-2026:10247-1",{"_key":107},"OPENSUSE-SU-2026:20184-1",{"_key":109},"MGASA-2026-0032",{"_key":111},"USN-8009-1",{"_key":113},"UBUNTU-CVE-2025-13473",{"_key":83},{"_key":116},"OPENSUSE-SU-2026:11270-1",[],[119,120,121,122,123,124,125,126],{"_key":95},{"_key":101},{"_key":103},{"_key":105},{"_key":107},{"_key":109},{"_key":116},{"_key":127},"CGA-5WCC-7WX7-J93F","2026-02-03T14:32:26.240Z","2026-02-03T16:19:15.167Z","Analyzed",{"cisa_kev":132,"cisa_ransomware":132,"cisa_vendor":9,"epss_severity":133,"epss_score":134,"severity":135,"severity_score":136,"severity_version":137,"severity_source":138,"severity_vector":139,"severity_status":130},false,"low",0.00741,"medium",5.3,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",[141,152,160,164,168,172,177,181,185,189,194,198,202],{"url":142,"sources":143,"tags":147},"https://docs.djangoproject.com/en/dev/releases/security/",[138,144,145,146],"nvd","osv_pypi","osv_chainguard",[148,149,150,151],"Vendor Advisory","Patch","FIX","Advisory",{"url":153,"sources":154,"tags":155},"https://groups.google.com/g/django-announce",[138,144,145,146],[156,157,158,151,159],"Mailing List","Release Notes","WEB","ARTICLE",{"url":161,"sources":162,"tags":163},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",[138,144,145,146],[148,149,150,151],{"url":165,"sources":166,"tags":167},"https://nvd.nist.gov/vuln/detail/CVE-2025-13473",[145,146],[151],{"url":169,"sources":170,"tags":171},"https://docs.djangoproject.com/en/dev/releases/security",[145],[158],{"url":173,"sources":174,"tags":175},"https://github.com/django/django",[145],[176],"PACKAGE",{"url":178,"sources":179,"tags":180},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases",[145],[158],{"url":182,"sources":183,"tags":184},"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-42.yaml",[145],[158],{"url":186,"sources":187,"tags":188},"https://github.com/advisories/GHSA-2mcm-79hx-8fxw",[145],[151],{"url":190,"sources":191,"tags":193},"https://security-tracker.debian.org/tracker/CVE-2025-13473",[192],"osv_debian",[151],{"url":195,"sources":196,"tags":197},"https://github.com/django/django/",[146],[158],{"url":199,"sources":200,"tags":201},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13473.json",[146],[151],{"url":203,"sources":204,"tags":205},"https://pypi.org/project/Django/",[146],[176],[],{"date":208,"score":134,"percentile":209},"2026-09-19",0.53153,[211,215,218,222,225,228,231,234,237,240,244,247,250,253,255,258,261,264,268,271,274,277,280,283,286,290,294,297,300,303,306,308,311,314,317,320,323,326,329,332,335,338,341,344,346,348,351,354,357,360,363,366,369,372,375,379,382,385,388,391,394,397,400,403,406,409,412,414,417,420,423,426,429,432,435,438,441,444,447,450,453,456,459,462,465,468,471,473,476,479],{"date":212,"score":213,"percentile":214},"2026-02-04",0.00029,0.07813,{"date":216,"score":213,"percentile":217},"2026-02-05",0.07866,{"date":219,"score":220,"percentile":221},"2026-02-06",0.00022,0.04996,{"date":223,"score":220,"percentile":224},"2026-02-07",0.05013,{"date":226,"score":220,"percentile":227},"2026-02-08",0.05003,{"date":229,"score":220,"percentile":230},"2026-02-09",0.05087,{"date":232,"score":220,"percentile":233},"2026-02-10",0.05082,{"date":235,"score":220,"percentile":236},"2026-02-11",0.05169,{"date":238,"score":220,"percentile":239},"2026-02-12",0.05222,{"date":241,"score":242,"percentile":243},"2026-02-13",0.00019,0.04361,{"date":245,"score":242,"percentile":246},"2026-02-14",0.04394,{"date":248,"score":242,"percentile":249},"2026-02-15",0.04415,{"date":251,"score":242,"percentile":252},"2026-02-16",0.04411,{"date":254,"score":242,"percentile":246},"2026-02-17",{"date":256,"score":242,"percentile":257},"2026-02-18",0.04666,{"date":259,"score":242,"percentile":260},"2026-02-19",0.04726,{"date":262,"score":242,"percentile":263},"2026-02-20",0.04685,{"date":265,"score":266,"percentile":267},"2026-02-21",0.00024,0.06419,{"date":269,"score":266,"percentile":270},"2026-02-22",0.06411,{"date":272,"score":266,"percentile":273},"2026-02-23",0.06417,{"date":275,"score":266,"percentile":276},"2026-02-24",0.06408,{"date":278,"score":266,"percentile":279},"2026-02-25",0.0634,{"date":281,"score":266,"percentile":282},"2026-02-26",0.06288,{"date":284,"score":266,"percentile":285},"2026-02-27",0.06318,{"date":287,"score":288,"percentile":289},"2026-02-28",0.00032,0.08899,{"date":291,"score":292,"percentile":293},"2026-03-01",0.00037,0.10801,{"date":295,"score":292,"percentile":296},"2026-03-02",0.10743,{"date":298,"score":292,"percentile":299},"2026-03-03",0.10724,{"date":301,"score":288,"percentile":302},"2026-03-04",0.08836,{"date":304,"score":288,"percentile":305},"2026-03-05",0.08872,{"date":307,"score":288,"percentile":305},"2026-03-06",{"date":309,"score":292,"percentile":310},"2026-03-07",0.10651,{"date":312,"score":292,"percentile":313},"2026-03-08",0.10622,{"date":315,"score":292,"percentile":316},"2026-03-09",0.10583,{"date":318,"score":292,"percentile":319},"2026-03-10",0.10566,{"date":321,"score":292,"percentile":322},"2026-03-11",0.10586,{"date":324,"score":292,"percentile":325},"2026-03-12",0.10635,{"date":327,"score":292,"percentile":328},"2026-03-13",0.10648,{"date":330,"score":292,"percentile":331},"2026-03-14",0.10649,{"date":333,"score":292,"percentile":334},"2026-03-15",0.10625,{"date":336,"score":292,"percentile":337},"2026-03-16",0.10595,{"date":339,"score":292,"percentile":340},"2026-03-17",0.10573,{"date":342,"score":292,"percentile":343},"2026-03-18",0.10572,{"date":345,"score":292,"percentile":340},"2026-03-19",{"date":347,"score":292,"percentile":313},"2026-03-20",{"date":349,"score":292,"percentile":350},"2026-03-21",0.10799,{"date":352,"score":292,"percentile":353},"2026-03-22",0.1078,{"date":355,"score":292,"percentile":356},"2026-03-23",0.10732,{"date":358,"score":292,"percentile":359},"2026-03-24",0.10706,{"date":361,"score":292,"percentile":362},"2026-03-25",0.108,{"date":364,"score":292,"percentile":365},"2026-03-26",0.10893,{"date":367,"score":292,"percentile":368},"2026-03-27",0.10913,{"date":370,"score":292,"percentile":371},"2026-03-28",0.10929,{"date":373,"score":292,"percentile":374},"2026-03-29",0.10892,{"date":376,"score":377,"percentile":378},"2026-03-30",0.00031,0.0871,{"date":380,"score":377,"percentile":381},"2026-03-31",0.08677,{"date":383,"score":377,"percentile":384},"2026-04-01",0.08654,{"date":386,"score":377,"percentile":387},"2026-04-02",0.08681,{"date":389,"score":377,"percentile":390},"2026-04-03",0.08699,{"date":392,"score":377,"percentile":393},"2026-04-04",0.08729,{"date":395,"score":377,"percentile":396},"2026-04-05",0.08716,{"date":398,"score":377,"percentile":399},"2026-04-06",0.08642,{"date":401,"score":377,"percentile":402},"2026-04-07",0.08653,{"date":404,"score":377,"percentile":405},"2026-04-08",0.0873,{"date":407,"score":377,"percentile":408},"2026-04-09",0.08755,{"date":410,"score":377,"percentile":411},"2026-04-10",0.0876,{"date":413,"score":377,"percentile":408},"2026-04-11",{"date":415,"score":416,"percentile":328},"2026-04-12",0.00036,{"date":418,"score":416,"percentile":419},"2026-04-13",0.10623,{"date":421,"score":416,"percentile":422},"2026-04-14",0.10479,{"date":424,"score":416,"percentile":425},"2026-04-15",0.10499,{"date":427,"score":416,"percentile":428},"2026-04-16",0.10488,{"date":430,"score":416,"percentile":431},"2026-04-17",0.10502,{"date":433,"score":416,"percentile":434},"2026-04-18",0.10506,{"date":436,"score":416,"percentile":437},"2026-04-19",0.10473,{"date":439,"score":416,"percentile":440},"2026-04-20",0.10462,{"date":442,"score":416,"percentile":443},"2026-04-21",0.10631,{"date":445,"score":416,"percentile":446},"2026-04-22",0.1067,{"date":448,"score":416,"percentile":449},"2026-04-23",0.1069,{"date":451,"score":416,"percentile":452},"2026-04-24",0.10579,{"date":454,"score":416,"percentile":455},"2026-04-25",0.10609,{"date":457,"score":416,"percentile":458},"2026-04-26",0.10578,{"date":460,"score":416,"percentile":461},"2026-04-27",0.10555,{"date":463,"score":416,"percentile":464},"2026-04-28",0.10524,{"date":466,"score":416,"percentile":467},"2026-04-29",0.10525,{"date":469,"score":416,"percentile":470},"2026-04-30",0.10519,{"date":472,"score":416,"percentile":470},"2026-05-01",{"date":474,"score":416,"percentile":475},"2026-05-02",0.10553,{"date":477,"score":416,"percentile":478},"2026-05-03",0.10538,{"date":480,"score":416,"percentile":481},"2026-05-04",0.10496,[483,488,490,494,496],{"source":138,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":484,"cvss_v4_0":9},{"baseScore":136,"baseSeverity":485,"vectorString":139,"impactScore":486,"exploitabilityScore":487},"MEDIUM",6,4.1,{"source":144,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":489,"cvss_v4_0":9},{"baseScore":136,"baseSeverity":485,"vectorString":139,"impactScore":486,"exploitabilityScore":487},{"source":145,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":491},{"baseScore":492,"baseSeverity":9,"vectorString":493,"impactScore":9,"exploitabilityScore":9},6.9,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",{"source":192,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":495,"cvss_v4_0":9},{"baseScore":136,"baseSeverity":9,"vectorString":139,"impactScore":486,"exploitabilityScore":487},{"source":146,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":497,"cvss_v4_0":9},{"baseScore":136,"baseSeverity":9,"vectorString":139,"impactScore":486,"exploitabilityScore":487},[499,511,515,521,527,545,564],{"ecosystem":500,"name":501,"vendor":502,"product":501,"cpe_part":9,"purl_type":503,"purl_namespace":502,"purl_name":501,"source":9,"versions":504},"Chainguard","authentik","chainguard","apk",[505],{"version":506,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":509,"version_end_type":510,"fixed_in":9},"lt2025_12_1_r2",true,"ecosystem","2025.12.1-r2","excluding",{"ecosystem":500,"name":512,"vendor":502,"product":512,"cpe_part":9,"purl_type":503,"purl_namespace":502,"purl_name":512,"source":9,"versions":513},"authentik-fips",[514],{"version":506,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":509,"version_end_type":510,"fixed_in":9},{"ecosystem":500,"name":516,"vendor":502,"product":516,"cpe_part":9,"purl_type":503,"purl_namespace":502,"purl_name":516,"source":9,"versions":517},"awx",[518],{"version":519,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":520,"version_end_type":510,"fixed_in":9},"lt24_6_1_r27","24.6.1-r27",{"ecosystem":500,"name":522,"vendor":502,"product":522,"cpe_part":9,"purl_type":503,"purl_namespace":502,"purl_name":522,"source":9,"versions":523},"label-studio",[524],{"version":525,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":526,"version_end_type":510,"fixed_in":9},"lt1_22_0_r3","1.22.0-r3",{"ecosystem":528,"name":529,"vendor":530,"product":529,"cpe_part":9,"purl_type":531,"purl_namespace":530,"purl_name":529,"source":9,"versions":532},"Debian","python-django","debian","deb",[533,536,539,542],{"version":534,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":535,"version_end_type":510,"fixed_in":9},"lt2:2_2_28_1~deb11u12","2:2.2.28-1~deb11u12",{"version":537,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":538,"version_end_type":510,"fixed_in":9},"lt3:3_2_25_0+deb12u2","3:3.2.25-0+deb12u2",{"version":540,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":541,"version_end_type":510,"fixed_in":9},"lt3:4_2_28_0+deb13u1","3:4.2.28-0+deb13u1",{"version":543,"is_range":507,"range_type":508,"version_start":9,"version_start_type":9,"version_end":544,"version_end_type":510,"fixed_in":9},"lt3:4_2_28_1","3:4.2.28-1",{"ecosystem":9,"name":546,"vendor":547,"product":546,"cpe_part":548,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":549},"django","djangoproject","a",[550,556,560],{"version":551,"is_range":507,"range_type":552,"version_start":553,"version_start_type":554,"version_end":555,"version_end_type":510,"fixed_in":9},"gte4.2_lt4.2.28","cpe","4.2","including","4.2.28",{"version":557,"is_range":507,"range_type":552,"version_start":558,"version_start_type":554,"version_end":559,"version_end_type":510,"fixed_in":9},"gte5.2_lt5.2.11","5.2","5.2.11",{"version":561,"is_range":507,"range_type":552,"version_start":562,"version_start_type":554,"version_end":563,"version_end_type":510,"fixed_in":9},"gte6.0_lt6.0.2","6.0","6.0.2",{"ecosystem":565,"name":546,"vendor":565,"product":546,"cpe_part":9,"purl_type":566,"purl_namespace":9,"purl_name":546,"source":9,"versions":567},"PyPI","pypi",[568,570,573,576],{"version":569,"is_range":507,"range_type":508,"version_start":562,"version_start_type":554,"version_end":563,"version_end_type":510,"fixed_in":9},"gte6_0_lt6_0_2",{"version":571,"is_range":507,"range_type":508,"version_start":572,"version_start_type":554,"version_end":563,"version_end_type":510,"fixed_in":9},"gte6_0a1_lt6_0_2","6.0a1",{"version":574,"is_range":507,"range_type":508,"version_start":575,"version_start_type":554,"version_end":559,"version_end_type":510,"fixed_in":9},"gte5_2a1_lt5_2_11","5.2a1",{"version":577,"is_range":507,"range_type":508,"version_start":578,"version_start_type":554,"version_end":555,"version_end_type":510,"fixed_in":9},"gte4_2a1_lt4_2_28","4.2a1"]