[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-1207":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":45,"duplicate_of":9,"upstream":59,"downstream":61,"duplicates":96,"related":97,"reserved_at":9,"published_at":107,"modified_at":108,"state":109,"summary":110,"references_raw":118,"kevs":245,"epss":246,"epss_history":249,"metrics":525,"affected":541},"CVE-2026-1207","An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\nRaster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Tarek Nakkouch for reporting this issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-89","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-109","Object Relational Mapping Injection",[],{"id":29,"name":30,"techniques":31},"CAPEC-110","SQL Injection through SOAP Parameter Tampering",[],{"id":33,"name":34,"techniques":35},"CAPEC-470","Expanding Control over the Operating System from the Database",[],{"id":37,"name":38,"techniques":39},"CAPEC-66","SQL Injection",[],{"id":41,"name":42,"techniques":43},"CAPEC-7","Blind SQL Injection",[],[],[46,47,48,49,50,51,52,53,54,55,56,57,58],"GHSA-mwm9-4648-f68q","BIT-django-2026-1207","ECHO-37cc-2ae7-e3c8","PYSEC-2026-44","DEBIAN-CVE-2026-1207","CGA-6w2x-p3p6-q7fx","CGA-8gxx-wqv9-2mjf","CGA-96g2-h7vg-gfr2","CGA-9xvj-ghg4-9c36","CGA-gjpr-554h-wv37","CGA-h97x-qwc9-584h","CGA-q92j-cmx7-6q4j","CGA-wr8p-475h-fcp8",[60],{"_key":7},[62,64,66,68,70,72,74,76,78,79,81,82,84,86,88,90,92,94],{"_key":63},"OPENSUSE-SU-2026:10160-1",{"_key":65},"DLA-4484-1",{"_key":67},"DSA-6150-1",{"_key":69},"SUSE-SU-2026:0440-1",{"_key":71},"OPENSUSE-SU-2026:10145-1",{"_key":73},"OPENSUSE-SU-2026:10247-1",{"_key":75},"OPENSUSE-SU-2026:20184-1",{"_key":77},"MGASA-2026-0032",{"_key":7},{"_key":80},"USN-8009-1",{"_key":50},{"_key":83},"UBUNTU-CVE-2026-1207",{"_key":85},"OPENSUSE-SU-2026:11270-1",{"_key":87},"RHSA-2026:14835",{"_key":89},"RHSA-2026:5970",{"_key":91},"RHSA-2026:5971",{"_key":93},"RHSA-2026:3958",{"_key":95},"RHSA-2026:3959",[],[98,99,100,101,102,103,104,105],{"_key":63},{"_key":69},{"_key":71},{"_key":73},{"_key":75},{"_key":77},{"_key":85},{"_key":106},"CGA-5Q4R-X59P-QCWC","2026-02-03T14:35:33.721Z","2026-07-15T11:47:50.492Z","Modified",{"cisa_kev":111,"cisa_ransomware":111,"cisa_vendor":9,"epss_severity":112,"epss_score":113,"severity":112,"severity_score":114,"severity_version":115,"severity_source":116,"severity_vector":117,"severity_status":109},false,"medium",0.12976,5.4,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",[119,130,138,142,146,150,154,159,163,167,171,175,181,187,192,196,200,204,208,212,216,220,224,228,233,237,241],{"url":120,"sources":121,"tags":125},"https://docs.djangoproject.com/en/dev/releases/security/",[116,122,123,124],"nvd","osv_pypi","osv_chainguard",[126,127,128,129],"Vendor Advisory","Patch","FIX","Advisory",{"url":131,"sources":132,"tags":133},"https://groups.google.com/g/django-announce",[116,122,123,124],[134,135,136,129,137],"Mailing List","Release Notes","WEB","ARTICLE",{"url":139,"sources":140,"tags":141},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",[116,122,123,124],[126,127,128,129],{"url":143,"sources":144,"tags":145},"https://nvd.nist.gov/vuln/detail/CVE-2026-1207",[123,124],[129],{"url":147,"sources":148,"tags":149},"https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8",[123],[136],{"url":151,"sources":152,"tags":153},"https://docs.djangoproject.com/en/dev/releases/security",[123],[136],{"url":155,"sources":156,"tags":157},"https://github.com/django/django",[123],[158],"PACKAGE",{"url":160,"sources":161,"tags":162},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases",[123],[136],{"url":164,"sources":165,"tags":166},"https://advisory.echohq.com/cve/CVE-2026-1207",[123],[136],{"url":168,"sources":169,"tags":170},"https://github.com/advisories/GHSA-mwm9-4648-f68q",[123],[136,129],{"url":172,"sources":173,"tags":174},"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-44.yaml",[123],[136],{"url":176,"sources":177,"tags":178},"https://access.redhat.com/security/cve/CVE-2026-1207",[116,122,124],[179,180,129],"VDB Entry","X Refsource REDHAT",{"url":182,"sources":183,"tags":184},"https://bugzilla.redhat.com/show_bug.cgi?id=2436338",[116,122,124],[185,180,186],"Issue Tracking","REPORT",{"url":188,"sources":189,"tags":190},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1207.json",[116,122,124],[191,136],"X Sadp Csaf Vex",{"url":193,"sources":194,"tags":195},"https://access.redhat.com/errata/RHSA-2026:3959",[116,122,124],[126,180,129],{"url":197,"sources":198,"tags":199},"https://access.redhat.com/errata/RHSA-2026:5971",[116,122,124],[126,180,129],{"url":201,"sources":202,"tags":203},"https://access.redhat.com/errata/RHSA-2026:3958",[116,122,124],[126,180,129],{"url":205,"sources":206,"tags":207},"https://access.redhat.com/errata/RHSA-2026:5970",[116,122,124],[126,180,129],{"url":209,"sources":210,"tags":211},"https://access.redhat.com/errata/RHSA-2026:14835",[116,122,124],[126,180,129],{"url":213,"sources":214,"tags":215},"https://access.redhat.com/errata/RHSA-2026:3962",[116,122,124],[126,180,129],{"url":217,"sources":218,"tags":219},"https://access.redhat.com/errata/RHSA-2026:3960",[116,122,124],[126,180,129],{"url":221,"sources":222,"tags":223},"https://access.redhat.com/errata/RHSA-2026:2694",[116,122,124],[126,180,129],{"url":225,"sources":226,"tags":227},"https://access.redhat.com/errata/RHSA-2026:6291",[116,122,124],[126,180,129],{"url":229,"sources":230,"tags":232},"https://security-tracker.debian.org/tracker/CVE-2026-1207",[231],"osv_debian",[129],{"url":234,"sources":235,"tags":236},"https://github.com/django/django/",[124],[136],{"url":238,"sources":239,"tags":240},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1207.json",[124],[129],{"url":242,"sources":243,"tags":244},"https://pypi.org/project/Django/",[124],[158],[],{"date":247,"score":113,"percentile":248},"2026-09-19",0.96141,[250,254,257,261,264,267,271,275,277,280,282,285,288,292,295,299,303,306,310,314,317,320,322,325,328,330,334,337,340,343,346,349,353,356,359,362,365,368,371,373,376,379,382,385,388,391,394,397,400,404,407,410,413,416,419,423,426,429,432,436,439,442,445,448,451,454,457,460,464,467,469,472,475,478,480,483,485,488,491,494,497,500,503,505,507,510,514,517,520,523],{"date":251,"score":252,"percentile":253},"2026-02-04",0.00017,0.03311,{"date":255,"score":252,"percentile":256},"2026-02-05",0.03338,{"date":258,"score":259,"percentile":260},"2026-02-06",0.00013,0.01599,{"date":262,"score":259,"percentile":263},"2026-02-07",0.01626,{"date":265,"score":259,"percentile":266},"2026-02-08",0.01623,{"date":268,"score":269,"percentile":270},"2026-02-09",0.00014,0.02136,{"date":272,"score":273,"percentile":274},"2026-02-10",0.0496,0.8941,{"date":276,"score":273,"percentile":274},"2026-02-11",{"date":278,"score":273,"percentile":279},"2026-02-12",0.89417,{"date":281,"score":273,"percentile":279},"2026-02-13",{"date":283,"score":273,"percentile":284},"2026-02-14",0.89418,{"date":286,"score":273,"percentile":287},"2026-02-15",0.89424,{"date":289,"score":290,"percentile":291},"2026-02-16",0.03174,0.86639,{"date":293,"score":290,"percentile":294},"2026-02-17",0.86636,{"date":296,"score":297,"percentile":298},"2026-02-18",0.03728,0.87717,{"date":300,"score":301,"percentile":302},"2026-02-19",0.03788,0.87817,{"date":304,"score":301,"percentile":305},"2026-02-20",0.87823,{"date":307,"score":308,"percentile":309},"2026-02-21",0.0471,0.89161,{"date":311,"score":312,"percentile":313},"2026-02-22",0.04785,0.89265,{"date":315,"score":312,"percentile":316},"2026-02-23",0.89259,{"date":318,"score":312,"percentile":319},"2026-02-24",0.8926,{"date":321,"score":312,"percentile":316},"2026-02-25",{"date":323,"score":312,"percentile":324},"2026-02-26",0.89266,{"date":326,"score":312,"percentile":327},"2026-02-27",0.89267,{"date":329,"score":312,"percentile":327},"2026-02-28",{"date":331,"score":332,"percentile":333},"2026-03-01",0.07386,0.91611,{"date":335,"score":332,"percentile":336},"2026-03-02",0.91614,{"date":338,"score":332,"percentile":339},"2026-03-03",0.91622,{"date":341,"score":312,"percentile":342},"2026-03-04",0.8927,{"date":344,"score":312,"percentile":345},"2026-03-05",0.89285,{"date":347,"score":312,"percentile":348},"2026-03-06",0.89287,{"date":350,"score":351,"percentile":352},"2026-03-07",0.05462,0.90031,{"date":354,"score":351,"percentile":355},"2026-03-08",0.90029,{"date":357,"score":351,"percentile":358},"2026-03-09",0.90028,{"date":360,"score":351,"percentile":361},"2026-03-10",0.9003,{"date":363,"score":351,"percentile":364},"2026-03-11",0.90038,{"date":366,"score":351,"percentile":367},"2026-03-12",0.90045,{"date":369,"score":351,"percentile":370},"2026-03-13",0.9005,{"date":372,"score":351,"percentile":370},"2026-03-14",{"date":374,"score":351,"percentile":375},"2026-03-15",0.90057,{"date":377,"score":351,"percentile":378},"2026-03-16",0.90066,{"date":380,"score":351,"percentile":381},"2026-03-17",0.90072,{"date":383,"score":351,"percentile":384},"2026-03-18",0.90085,{"date":386,"score":351,"percentile":387},"2026-03-19",0.90087,{"date":389,"score":351,"percentile":390},"2026-03-20",0.90095,{"date":392,"score":351,"percentile":393},"2026-03-21",0.90101,{"date":395,"score":351,"percentile":396},"2026-03-22",0.90104,{"date":398,"score":351,"percentile":399},"2026-03-23",0.90107,{"date":401,"score":402,"percentile":403},"2026-03-24",0.05377,0.90023,{"date":405,"score":402,"percentile":406},"2026-03-25",0.90033,{"date":408,"score":351,"percentile":409},"2026-03-26",0.90136,{"date":411,"score":351,"percentile":412},"2026-03-27",0.90141,{"date":414,"score":351,"percentile":415},"2026-03-28",0.90145,{"date":417,"score":351,"percentile":418},"2026-03-29",0.90142,{"date":420,"score":421,"percentile":422},"2026-03-30",0.05126,0.89809,{"date":424,"score":421,"percentile":425},"2026-03-31",0.89812,{"date":427,"score":421,"percentile":428},"2026-04-01",0.89817,{"date":430,"score":421,"percentile":431},"2026-04-02",0.8982,{"date":433,"score":434,"percentile":435},"2026-04-03",0.03841,0.88141,{"date":437,"score":434,"percentile":438},"2026-04-04",0.88146,{"date":440,"score":434,"percentile":441},"2026-04-05",0.88145,{"date":443,"score":434,"percentile":444},"2026-04-06",0.88147,{"date":446,"score":434,"percentile":447},"2026-04-07",0.88153,{"date":449,"score":434,"percentile":450},"2026-04-08",0.88172,{"date":452,"score":434,"percentile":453},"2026-04-09",0.88178,{"date":455,"score":434,"percentile":456},"2026-04-10",0.88185,{"date":458,"score":434,"percentile":459},"2026-04-11",0.88188,{"date":461,"score":462,"percentile":463},"2026-04-12",0.04424,0.89037,{"date":465,"score":462,"percentile":466},"2026-04-13",0.89035,{"date":468,"score":462,"percentile":463},"2026-04-14",{"date":470,"score":462,"percentile":471},"2026-04-15",0.89045,{"date":473,"score":462,"percentile":474},"2026-04-16",0.89048,{"date":476,"score":462,"percentile":477},"2026-04-17",0.89047,{"date":479,"score":462,"percentile":474},"2026-04-18",{"date":481,"score":462,"percentile":482},"2026-04-19",0.89046,{"date":484,"score":462,"percentile":482},"2026-04-20",{"date":486,"score":462,"percentile":487},"2026-04-21",0.89043,{"date":489,"score":462,"percentile":490},"2026-04-22",0.89056,{"date":492,"score":462,"percentile":493},"2026-04-23",0.89064,{"date":495,"score":462,"percentile":496},"2026-04-24",0.89061,{"date":498,"score":462,"percentile":499},"2026-04-25",0.89067,{"date":501,"score":462,"percentile":502},"2026-04-26",0.89068,{"date":504,"score":462,"percentile":499},"2026-04-27",{"date":506,"score":462,"percentile":502},"2026-04-28",{"date":508,"score":462,"percentile":509},"2026-04-29",0.8907,{"date":511,"score":512,"percentile":513},"2026-04-30",0.05295,0.90053,{"date":515,"score":512,"percentile":516},"2026-05-01",0.90055,{"date":518,"score":512,"percentile":519},"2026-05-02",0.90061,{"date":521,"score":512,"percentile":522},"2026-05-03",0.9006,{"date":524,"score":512,"percentile":519},"2026-05-04",[526,531,533,537,539],{"source":116,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":527,"cvss_v4_0":9},{"baseScore":114,"baseSeverity":528,"vectorString":117,"impactScore":529,"exploitabilityScore":530},"MEDIUM",4.2,7.2,{"source":122,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":532,"cvss_v4_0":9},{"baseScore":114,"baseSeverity":528,"vectorString":117,"impactScore":529,"exploitabilityScore":530},{"source":123,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":534},{"baseScore":535,"baseSeverity":9,"vectorString":536,"impactScore":9,"exploitabilityScore":9},9.3,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",{"source":231,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":538,"cvss_v4_0":9},{"baseScore":114,"baseSeverity":9,"vectorString":117,"impactScore":529,"exploitabilityScore":530},{"source":124,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":540,"cvss_v4_0":9},{"baseScore":114,"baseSeverity":9,"vectorString":117,"impactScore":529,"exploitabilityScore":530},[542,554,558,564,570,588,607],{"ecosystem":543,"name":544,"vendor":545,"product":544,"cpe_part":9,"purl_type":546,"purl_namespace":545,"purl_name":544,"source":9,"versions":547},"Chainguard","authentik","chainguard","apk",[548],{"version":549,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":552,"version_end_type":553,"fixed_in":9},"lt2025_12_1_r2",true,"ecosystem","2025.12.1-r2","excluding",{"ecosystem":543,"name":555,"vendor":545,"product":555,"cpe_part":9,"purl_type":546,"purl_namespace":545,"purl_name":555,"source":9,"versions":556},"authentik-fips",[557],{"version":549,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":552,"version_end_type":553,"fixed_in":9},{"ecosystem":543,"name":559,"vendor":545,"product":559,"cpe_part":9,"purl_type":546,"purl_namespace":545,"purl_name":559,"source":9,"versions":560},"awx",[561],{"version":562,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":563,"version_end_type":553,"fixed_in":9},"lt24_6_1_r27","24.6.1-r27",{"ecosystem":543,"name":565,"vendor":545,"product":565,"cpe_part":9,"purl_type":546,"purl_namespace":545,"purl_name":565,"source":9,"versions":566},"label-studio",[567],{"version":568,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":569,"version_end_type":553,"fixed_in":9},"lt1_22_0_r3","1.22.0-r3",{"ecosystem":571,"name":572,"vendor":573,"product":572,"cpe_part":9,"purl_type":574,"purl_namespace":573,"purl_name":572,"source":9,"versions":575},"Debian","python-django","debian","deb",[576,579,582,585],{"version":577,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":578,"version_end_type":553,"fixed_in":9},"lt2:2_2_28_1~deb11u12","2:2.2.28-1~deb11u12",{"version":580,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":581,"version_end_type":553,"fixed_in":9},"lt3:3_2_25_0+deb12u2","3:3.2.25-0+deb12u2",{"version":583,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":584,"version_end_type":553,"fixed_in":9},"lt3:4_2_28_0+deb13u1","3:4.2.28-0+deb13u1",{"version":586,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":587,"version_end_type":553,"fixed_in":9},"lt3:4_2_28_1","3:4.2.28-1",{"ecosystem":9,"name":589,"vendor":590,"product":589,"cpe_part":591,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":592},"django","djangoproject","a",[593,599,603],{"version":594,"is_range":550,"range_type":595,"version_start":596,"version_start_type":597,"version_end":598,"version_end_type":553,"fixed_in":9},"gte4.2_lt4.2.28","cpe","4.2","including","4.2.28",{"version":600,"is_range":550,"range_type":595,"version_start":601,"version_start_type":597,"version_end":602,"version_end_type":553,"fixed_in":9},"gte5.2_lt5.2.11","5.2","5.2.11",{"version":604,"is_range":550,"range_type":595,"version_start":605,"version_start_type":597,"version_end":606,"version_end_type":553,"fixed_in":9},"gte6.0_lt6.0.2","6.0","6.0.2",{"ecosystem":608,"name":589,"vendor":608,"product":589,"cpe_part":9,"purl_type":609,"purl_namespace":9,"purl_name":589,"source":9,"versions":610},"PyPI","pypi",[611,614,616,619,622],{"version":612,"is_range":550,"range_type":551,"version_start":9,"version_start_type":9,"version_end":613,"version_end_type":553,"fixed_in":9},"lt5_2_1+echo_1","5.2.1+echo.1",{"version":615,"is_range":550,"range_type":551,"version_start":605,"version_start_type":597,"version_end":606,"version_end_type":553,"fixed_in":9},"gte6_0_lt6_0_2",{"version":617,"is_range":550,"range_type":551,"version_start":618,"version_start_type":597,"version_end":606,"version_end_type":553,"fixed_in":9},"gte6_0a1_lt6_0_2","6.0a1",{"version":620,"is_range":550,"range_type":551,"version_start":621,"version_start_type":597,"version_end":602,"version_end_type":553,"fixed_in":9},"gte5_2a1_lt5_2_11","5.2a1",{"version":623,"is_range":550,"range_type":551,"version_start":624,"version_start_type":597,"version_end":598,"version_end_type":553,"fixed_in":9},"gte4_2a1_lt4_2_28","4.2a1"]