[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-1287":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":45,"duplicate_of":9,"upstream":59,"downstream":61,"duplicates":96,"related":97,"reserved_at":9,"published_at":107,"modified_at":108,"state":109,"summary":110,"references_raw":119,"kevs":246,"epss":247,"epss_history":250,"metrics":509,"affected":525},"CVE-2026-1287","An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet` methods `annotate()`, `aggregate()`, `extra()`, `values()`, `values_list()`, and `alias()`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-89","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-109","Object Relational Mapping Injection",[],{"id":29,"name":30,"techniques":31},"CAPEC-110","SQL Injection through SOAP Parameter Tampering",[],{"id":33,"name":34,"techniques":35},"CAPEC-470","Expanding Control over the Operating System from the Database",[],{"id":37,"name":38,"techniques":39},"CAPEC-66","SQL Injection",[],{"id":41,"name":42,"techniques":43},"CAPEC-7","Blind SQL Injection",[],[],[46,47,48,49,50,51,52,53,54,55,56,57,58],"GHSA-gvg8-93h5-g6qq","BIT-django-2026-1287","ECHO-f04c-582a-df62","PYSEC-2026-46","DEBIAN-CVE-2026-1287","CGA-269h-q657-qff6","CGA-2mcp-6c25-v6h8","CGA-3876-89j2-fcpx","CGA-3v52-vvcj-c6hw","CGA-7635-f895-5fhg","CGA-8vvw-q2mf-c362","CGA-j2r6-cjjp-p58g","CGA-m6jc-gggg-6mpx",[60],{"_key":7},[62,64,66,68,70,72,74,76,78,79,81,82,84,86,88,90,92,94],{"_key":63},"OPENSUSE-SU-2026:10160-1",{"_key":65},"DLA-4484-1",{"_key":67},"DSA-6150-1",{"_key":69},"SUSE-SU-2026:0440-1",{"_key":71},"OPENSUSE-SU-2026:10145-1",{"_key":73},"OPENSUSE-SU-2026:10247-1",{"_key":75},"OPENSUSE-SU-2026:20184-1",{"_key":77},"MGASA-2026-0032",{"_key":7},{"_key":80},"USN-8009-1",{"_key":50},{"_key":83},"UBUNTU-CVE-2026-1287",{"_key":85},"OPENSUSE-SU-2026:11270-1",{"_key":87},"RHSA-2026:14835",{"_key":89},"RHSA-2026:5970",{"_key":91},"RHSA-2026:5971",{"_key":93},"RHSA-2026:3958",{"_key":95},"RHSA-2026:3959",[],[98,99,100,101,102,103,104,105],{"_key":63},{"_key":69},{"_key":71},{"_key":73},{"_key":75},{"_key":77},{"_key":85},{"_key":106},"CGA-5C9Q-6M5J-82RH","2026-02-03T14:36:03.630Z","2026-07-15T01:22:05.871Z","Modified",{"cisa_kev":111,"cisa_ransomware":111,"cisa_vendor":9,"epss_severity":112,"epss_score":113,"severity":114,"severity_score":115,"severity_version":116,"severity_source":117,"severity_vector":118,"severity_status":109},false,"low",0.00783,"medium",5.4,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",[120,131,139,143,147,151,155,160,164,168,172,176,182,188,193,197,201,205,209,213,217,221,225,229,234,238,242],{"url":121,"sources":122,"tags":126},"https://docs.djangoproject.com/en/dev/releases/security/",[117,123,124,125],"nvd","osv_pypi","osv_chainguard",[127,128,129,130],"Vendor Advisory","Patch","FIX","Advisory",{"url":132,"sources":133,"tags":134},"https://groups.google.com/g/django-announce",[117,123,124,125],[135,136,137,130,138],"Mailing List","Release Notes","WEB","ARTICLE",{"url":140,"sources":141,"tags":142},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",[117,123,124,125],[127,128,129,130],{"url":144,"sources":145,"tags":146},"https://nvd.nist.gov/vuln/detail/CVE-2026-1287",[124,125],[130],{"url":148,"sources":149,"tags":150},"https://github.com/django/django/commit/e891a84c7ef9962bfcc3b4685690219542f86a22",[124],[137],{"url":152,"sources":153,"tags":154},"https://docs.djangoproject.com/en/dev/releases/security",[124],[137],{"url":156,"sources":157,"tags":158},"https://github.com/django/django",[124],[159],"PACKAGE",{"url":161,"sources":162,"tags":163},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases",[124],[137],{"url":165,"sources":166,"tags":167},"https://advisory.echohq.com/cve/CVE-2026-1287",[124],[137],{"url":169,"sources":170,"tags":171},"https://github.com/advisories/GHSA-gvg8-93h5-g6qq",[124],[137,130],{"url":173,"sources":174,"tags":175},"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-46.yaml",[124],[137],{"url":177,"sources":178,"tags":179},"https://access.redhat.com/security/cve/CVE-2026-1287",[117,123,125],[180,181,130],"VDB Entry","X Refsource REDHAT",{"url":183,"sources":184,"tags":185},"https://bugzilla.redhat.com/show_bug.cgi?id=2436339",[117,123,125],[186,181,187],"Issue Tracking","REPORT",{"url":189,"sources":190,"tags":191},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1287.json",[117,123,125],[192,137],"X Sadp Csaf Vex",{"url":194,"sources":195,"tags":196},"https://access.redhat.com/errata/RHSA-2026:3959",[117,123,125],[127,181,130],{"url":198,"sources":199,"tags":200},"https://access.redhat.com/errata/RHSA-2026:5971",[117,123,125],[127,181,130],{"url":202,"sources":203,"tags":204},"https://access.redhat.com/errata/RHSA-2026:3958",[117,123,125],[127,181,130],{"url":206,"sources":207,"tags":208},"https://access.redhat.com/errata/RHSA-2026:5970",[117,123,125],[127,181,130],{"url":210,"sources":211,"tags":212},"https://access.redhat.com/errata/RHSA-2026:14835",[117,123,125],[127,181,130],{"url":214,"sources":215,"tags":216},"https://access.redhat.com/errata/RHSA-2026:3962",[117,123,125],[127,181,130],{"url":218,"sources":219,"tags":220},"https://access.redhat.com/errata/RHSA-2026:3960",[117,123,125],[127,181,130],{"url":222,"sources":223,"tags":224},"https://access.redhat.com/errata/RHSA-2026:2694",[117,123,125],[127,181,130],{"url":226,"sources":227,"tags":228},"https://access.redhat.com/errata/RHSA-2026:6291",[117,123,125],[127,181,130],{"url":230,"sources":231,"tags":233},"https://security-tracker.debian.org/tracker/CVE-2026-1287",[232],"osv_debian",[130],{"url":235,"sources":236,"tags":237},"https://github.com/django/django/",[125],[137],{"url":239,"sources":240,"tags":241},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1287.json",[125],[130],{"url":243,"sources":244,"tags":245},"https://pypi.org/project/Django/",[125],[159],[],{"date":248,"score":113,"percentile":249},"2026-09-19",0.54493,[251,255,258,262,264,267,271,273,276,279,282,284,287,290,293,296,298,301,304,306,309,312,315,318,321,323,326,329,332,335,338,340,344,347,350,353,356,359,361,364,367,370,373,376,379,382,385,388,390,393,396,399,402,405,408,411,414,417,420,422,425,428,430,433,435,438,440,443,447,450,453,456,459,462,465,468,471,474,477,480,483,485,488,491,493,496,499,502,504,506],{"date":252,"score":253,"percentile":254},"2026-02-04",0.0001,0.00973,{"date":256,"score":253,"percentile":257},"2026-02-05",0.00877,{"date":259,"score":260,"percentile":261},"2026-02-06",0.00007,0.00494,{"date":263,"score":260,"percentile":261},"2026-02-07",{"date":265,"score":260,"percentile":266},"2026-02-08",0.00491,{"date":268,"score":269,"percentile":270},"2026-02-09",0.00008,0.00601,{"date":272,"score":269,"percentile":270},"2026-02-10",{"date":274,"score":269,"percentile":275},"2026-02-11",0.00615,{"date":277,"score":269,"percentile":278},"2026-02-12",0.00616,{"date":280,"score":269,"percentile":281},"2026-02-13",0.00613,{"date":283,"score":269,"percentile":281},"2026-02-14",{"date":285,"score":269,"percentile":286},"2026-02-15",0.00611,{"date":288,"score":269,"percentile":289},"2026-02-16",0.00608,{"date":291,"score":269,"percentile":292},"2026-02-17",0.00604,{"date":294,"score":269,"percentile":295},"2026-02-18",0.00676,{"date":297,"score":269,"percentile":295},"2026-02-19",{"date":299,"score":269,"percentile":300},"2026-02-20",0.00682,{"date":302,"score":253,"percentile":303},"2026-02-21",0.01143,{"date":305,"score":253,"percentile":303},"2026-02-22",{"date":307,"score":253,"percentile":308},"2026-02-23",0.01114,{"date":310,"score":253,"percentile":311},"2026-02-24",0.01094,{"date":313,"score":253,"percentile":314},"2026-02-25",0.01093,{"date":316,"score":253,"percentile":317},"2026-02-26",0.01084,{"date":319,"score":253,"percentile":320},"2026-02-27",0.01088,{"date":322,"score":253,"percentile":311},"2026-02-28",{"date":324,"score":253,"percentile":325},"2026-03-01",0.01107,{"date":327,"score":253,"percentile":328},"2026-03-02",0.01101,{"date":330,"score":253,"percentile":331},"2026-03-03",0.01124,{"date":333,"score":253,"percentile":334},"2026-03-04",0.0111,{"date":336,"score":253,"percentile":337},"2026-03-05",0.01121,{"date":339,"score":253,"percentile":331},"2026-03-06",{"date":341,"score":342,"percentile":343},"2026-03-07",0.00012,0.01641,{"date":345,"score":342,"percentile":346},"2026-03-08",0.01638,{"date":348,"score":342,"percentile":349},"2026-03-09",0.01628,{"date":351,"score":342,"percentile":352},"2026-03-10",0.01624,{"date":354,"score":342,"percentile":355},"2026-03-11",0.01583,{"date":357,"score":342,"percentile":358},"2026-03-12",0.01591,{"date":360,"score":342,"percentile":355},"2026-03-13",{"date":362,"score":342,"percentile":363},"2026-03-14",0.01545,{"date":365,"score":342,"percentile":366},"2026-03-15",0.01535,{"date":368,"score":342,"percentile":369},"2026-03-16",0.01527,{"date":371,"score":342,"percentile":372},"2026-03-17",0.01498,{"date":374,"score":342,"percentile":375},"2026-03-18",0.01495,{"date":377,"score":342,"percentile":378},"2026-03-19",0.01489,{"date":380,"score":342,"percentile":381},"2026-03-20",0.0149,{"date":383,"score":342,"percentile":384},"2026-03-21",0.01621,{"date":386,"score":342,"percentile":387},"2026-03-22",0.01619,{"date":389,"score":342,"percentile":387},"2026-03-23",{"date":391,"score":342,"percentile":392},"2026-03-24",0.01611,{"date":394,"score":342,"percentile":395},"2026-03-25",0.01606,{"date":397,"score":342,"percentile":398},"2026-03-26",0.01614,{"date":400,"score":342,"percentile":401},"2026-03-27",0.01616,{"date":403,"score":342,"percentile":404},"2026-03-28",0.01617,{"date":406,"score":342,"percentile":407},"2026-03-29",0.01612,{"date":409,"score":253,"percentile":410},"2026-03-30",0.01078,{"date":412,"score":253,"percentile":413},"2026-03-31",0.01063,{"date":415,"score":253,"percentile":416},"2026-04-01",0.01062,{"date":418,"score":253,"percentile":419},"2026-04-02",0.01069,{"date":421,"score":253,"percentile":419},"2026-04-03",{"date":423,"score":253,"percentile":424},"2026-04-04",0.01072,{"date":426,"score":253,"percentile":427},"2026-04-05",0.01071,{"date":429,"score":253,"percentile":410},"2026-04-06",{"date":431,"score":253,"percentile":432},"2026-04-07",0.01079,{"date":434,"score":253,"percentile":317},"2026-04-08",{"date":436,"score":253,"percentile":437},"2026-04-09",0.01083,{"date":439,"score":253,"percentile":432},"2026-04-10",{"date":441,"score":253,"percentile":442},"2026-04-11",0.01067,{"date":444,"score":445,"percentile":446},"2026-04-12",0.00011,0.01443,{"date":448,"score":445,"percentile":449},"2026-04-13",0.01444,{"date":451,"score":445,"percentile":452},"2026-04-14",0.01427,{"date":454,"score":445,"percentile":455},"2026-04-15",0.01423,{"date":457,"score":445,"percentile":458},"2026-04-16",0.01433,{"date":460,"score":445,"percentile":461},"2026-04-17",0.0144,{"date":463,"score":445,"percentile":464},"2026-04-18",0.01446,{"date":466,"score":445,"percentile":467},"2026-04-19",0.01445,{"date":469,"score":445,"percentile":470},"2026-04-20",0.01439,{"date":472,"score":445,"percentile":473},"2026-04-21",0.01534,{"date":475,"score":445,"percentile":476},"2026-04-22",0.0154,{"date":478,"score":445,"percentile":479},"2026-04-23",0.01548,{"date":481,"score":445,"percentile":482},"2026-04-24",0.01541,{"date":484,"score":445,"percentile":482},"2026-04-25",{"date":486,"score":445,"percentile":487},"2026-04-26",0.01539,{"date":489,"score":445,"percentile":490},"2026-04-27",0.01555,{"date":492,"score":445,"percentile":482},"2026-04-28",{"date":494,"score":445,"percentile":495},"2026-04-29",0.01549,{"date":497,"score":445,"percentile":498},"2026-04-30",0.01542,{"date":500,"score":445,"percentile":501},"2026-05-01",0.01537,{"date":503,"score":445,"percentile":473},"2026-05-02",{"date":505,"score":445,"percentile":473},"2026-05-03",{"date":507,"score":445,"percentile":508},"2026-05-04",0.01533,[510,515,517,521,523],{"source":117,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":511,"cvss_v4_0":9},{"baseScore":115,"baseSeverity":512,"vectorString":118,"impactScore":513,"exploitabilityScore":514},"MEDIUM",4.2,7.2,{"source":123,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":516,"cvss_v4_0":9},{"baseScore":115,"baseSeverity":512,"vectorString":118,"impactScore":513,"exploitabilityScore":514},{"source":124,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":518},{"baseScore":519,"baseSeverity":9,"vectorString":520,"impactScore":9,"exploitabilityScore":9},9.3,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",{"source":232,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":522,"cvss_v4_0":9},{"baseScore":115,"baseSeverity":9,"vectorString":118,"impactScore":513,"exploitabilityScore":514},{"source":125,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":524,"cvss_v4_0":9},{"baseScore":115,"baseSeverity":9,"vectorString":118,"impactScore":513,"exploitabilityScore":514},[526,538,542,548,554,572,591],{"ecosystem":527,"name":528,"vendor":529,"product":528,"cpe_part":9,"purl_type":530,"purl_namespace":529,"purl_name":528,"source":9,"versions":531},"Chainguard","authentik","chainguard","apk",[532],{"version":533,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":536,"version_end_type":537,"fixed_in":9},"lt2025_12_1_r2",true,"ecosystem","2025.12.1-r2","excluding",{"ecosystem":527,"name":539,"vendor":529,"product":539,"cpe_part":9,"purl_type":530,"purl_namespace":529,"purl_name":539,"source":9,"versions":540},"authentik-fips",[541],{"version":533,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":536,"version_end_type":537,"fixed_in":9},{"ecosystem":527,"name":543,"vendor":529,"product":543,"cpe_part":9,"purl_type":530,"purl_namespace":529,"purl_name":543,"source":9,"versions":544},"awx",[545],{"version":546,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":547,"version_end_type":537,"fixed_in":9},"lt24_6_1_r27","24.6.1-r27",{"ecosystem":527,"name":549,"vendor":529,"product":549,"cpe_part":9,"purl_type":530,"purl_namespace":529,"purl_name":549,"source":9,"versions":550},"label-studio",[551],{"version":552,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":553,"version_end_type":537,"fixed_in":9},"lt1_22_0_r3","1.22.0-r3",{"ecosystem":555,"name":556,"vendor":557,"product":556,"cpe_part":9,"purl_type":558,"purl_namespace":557,"purl_name":556,"source":9,"versions":559},"Debian","python-django","debian","deb",[560,563,566,569],{"version":561,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":562,"version_end_type":537,"fixed_in":9},"lt2:2_2_28_1~deb11u12","2:2.2.28-1~deb11u12",{"version":564,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":565,"version_end_type":537,"fixed_in":9},"lt3:3_2_25_0+deb12u2","3:3.2.25-0+deb12u2",{"version":567,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":568,"version_end_type":537,"fixed_in":9},"lt3:4_2_28_0+deb13u1","3:4.2.28-0+deb13u1",{"version":570,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":571,"version_end_type":537,"fixed_in":9},"lt3:4_2_28_1","3:4.2.28-1",{"ecosystem":9,"name":573,"vendor":574,"product":573,"cpe_part":575,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":576},"django","djangoproject","a",[577,583,587],{"version":578,"is_range":534,"range_type":579,"version_start":580,"version_start_type":581,"version_end":582,"version_end_type":537,"fixed_in":9},"gte4.2_lt4.2.28","cpe","4.2","including","4.2.28",{"version":584,"is_range":534,"range_type":579,"version_start":585,"version_start_type":581,"version_end":586,"version_end_type":537,"fixed_in":9},"gte5.2_lt5.2.11","5.2","5.2.11",{"version":588,"is_range":534,"range_type":579,"version_start":589,"version_start_type":581,"version_end":590,"version_end_type":537,"fixed_in":9},"gte6.0_lt6.0.2","6.0","6.0.2",{"ecosystem":592,"name":573,"vendor":592,"product":573,"cpe_part":9,"purl_type":593,"purl_namespace":9,"purl_name":573,"source":9,"versions":594},"PyPI","pypi",[595,598,600,603,606],{"version":596,"is_range":534,"range_type":535,"version_start":9,"version_start_type":9,"version_end":597,"version_end_type":537,"fixed_in":9},"lt5_2_1+echo_1","5.2.1+echo.1",{"version":599,"is_range":534,"range_type":535,"version_start":589,"version_start_type":581,"version_end":590,"version_end_type":537,"fixed_in":9},"gte6_0_lt6_0_2",{"version":601,"is_range":534,"range_type":535,"version_start":602,"version_start_type":581,"version_end":590,"version_end_type":537,"fixed_in":9},"gte6_0a1_lt6_0_2","6.0a1",{"version":604,"is_range":534,"range_type":535,"version_start":605,"version_start_type":581,"version_end":586,"version_end_type":537,"fixed_in":9},"gte5_2a1_lt5_2_11","5.2a1",{"version":607,"is_range":534,"range_type":535,"version_start":608,"version_start_type":581,"version_end":582,"version_end_type":537,"fixed_in":9},"gte4_2a1_lt4_2_28","4.2a1"]