[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-1312":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":45,"duplicate_of":9,"upstream":58,"downstream":59,"duplicates":93,"related":94,"reserved_at":9,"published_at":104,"modified_at":105,"state":106,"summary":107,"references_raw":116,"kevs":243,"epss":244,"epss_history":247,"metrics":506,"affected":520},"CVE-2026-1312","An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.\n`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used in `FilteredRelation`.\nEarlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.\nDjango would like to thank Solomon Kebede for reporting this issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-89","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-109","Object Relational Mapping Injection",[],{"id":29,"name":30,"techniques":31},"CAPEC-110","SQL Injection through SOAP Parameter Tampering",[],{"id":33,"name":34,"techniques":35},"CAPEC-470","Expanding Control over the Operating System from the Database",[],{"id":37,"name":38,"techniques":39},"CAPEC-66","SQL Injection",[],{"id":41,"name":42,"techniques":43},"CAPEC-7","Blind SQL Injection",[],[],[46,47,48,49,50,51,52,53,54,55,56,57],"GHSA-6426-9fv3-65x8","BIT-django-2026-1312","PYSEC-2026-47","DEBIAN-CVE-2026-1312","CGA-4r5r-xx3g-845g","CGA-63wr-54xf-8vxj","CGA-6g4r-vc24-7rr4","CGA-7qvv-q49g-52r5","CGA-h68c-frr8-2rq7","CGA-j8c5-jj63-q9f6","CGA-pp84-f7wq-5p83","CGA-wfpq-93wc-pvv3",[],[60,62,64,66,68,70,72,74,76,78,79,81,83,85,87,89,91],{"_key":61},"OPENSUSE-SU-2026:10160-1",{"_key":63},"DLA-4484-1",{"_key":65},"DSA-6150-1",{"_key":67},"SUSE-SU-2026:0440-1",{"_key":69},"OPENSUSE-SU-2026:10145-1",{"_key":71},"OPENSUSE-SU-2026:10247-1",{"_key":73},"OPENSUSE-SU-2026:20184-1",{"_key":75},"MGASA-2026-0032",{"_key":77},"USN-8009-1",{"_key":49},{"_key":80},"UBUNTU-CVE-2026-1312",{"_key":82},"OPENSUSE-SU-2026:11270-1",{"_key":84},"RHSA-2026:14835",{"_key":86},"RHSA-2026:5970",{"_key":88},"RHSA-2026:5971",{"_key":90},"RHSA-2026:3958",{"_key":92},"RHSA-2026:3959",[],[95,96,97,98,99,100,101,102],{"_key":61},{"_key":67},{"_key":69},{"_key":71},{"_key":73},{"_key":75},{"_key":82},{"_key":103},"CGA-RP2J-R5M6-5P6G","2026-02-03T14:36:23.257Z","2026-07-15T01:21:55.722Z","Modified",{"cisa_kev":108,"cisa_ransomware":108,"cisa_vendor":9,"epss_severity":109,"epss_score":110,"severity":111,"severity_score":112,"severity_version":113,"severity_source":114,"severity_vector":115,"severity_status":106},false,"low",0.00833,"medium",5.4,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",[117,128,136,140,144,148,152,156,161,165,169,173,179,185,190,194,198,202,206,210,214,218,222,226,231,235,239],{"url":118,"sources":119,"tags":123},"https://docs.djangoproject.com/en/dev/releases/security/",[114,120,121,122],"nvd","osv_pypi","osv_chainguard",[124,125,126,127],"Vendor Advisory","Patch","FIX","Advisory",{"url":129,"sources":130,"tags":131},"https://groups.google.com/g/django-announce",[114,120,121,122],[132,133,134,127,135],"Mailing List","Release Notes","WEB","ARTICLE",{"url":137,"sources":138,"tags":139},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases/",[114,120,121,122],[124,125,126,127],{"url":141,"sources":142,"tags":143},"https://nvd.nist.gov/vuln/detail/CVE-2026-1312",[121,122],[127],{"url":145,"sources":146,"tags":147},"https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84",[121],[134],{"url":149,"sources":150,"tags":151},"https://github.com/django/django/commit/69065ca869b0970dff8fdd8fafb390bf8b3bf222",[121],[134],{"url":153,"sources":154,"tags":155},"https://docs.djangoproject.com/en/dev/releases/security",[121],[134],{"url":157,"sources":158,"tags":159},"https://github.com/django/django",[121],[160],"PACKAGE",{"url":162,"sources":163,"tags":164},"https://www.djangoproject.com/weblog/2026/feb/03/security-releases",[121],[134],{"url":166,"sources":167,"tags":168},"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-47.yaml",[121],[134],{"url":170,"sources":171,"tags":172},"https://github.com/advisories/GHSA-6426-9fv3-65x8",[121],[127],{"url":174,"sources":175,"tags":176},"https://access.redhat.com/security/cve/CVE-2026-1312",[114,120,122],[177,178,127],"VDB Entry","X Refsource REDHAT",{"url":180,"sources":181,"tags":182},"https://bugzilla.redhat.com/show_bug.cgi?id=2436342",[114,120,122],[183,178,184],"Issue Tracking","REPORT",{"url":186,"sources":187,"tags":188},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1312.json",[114,120,122],[189,134],"X Sadp Csaf Vex",{"url":191,"sources":192,"tags":193},"https://access.redhat.com/errata/RHSA-2026:3959",[114,120,122],[124,178,127],{"url":195,"sources":196,"tags":197},"https://access.redhat.com/errata/RHSA-2026:5971",[114,120,122],[124,178,127],{"url":199,"sources":200,"tags":201},"https://access.redhat.com/errata/RHSA-2026:3958",[114,120,122],[124,178,127],{"url":203,"sources":204,"tags":205},"https://access.redhat.com/errata/RHSA-2026:5970",[114,120,122],[124,178,127],{"url":207,"sources":208,"tags":209},"https://access.redhat.com/errata/RHSA-2026:14835",[114,120,122],[124,178,127],{"url":211,"sources":212,"tags":213},"https://access.redhat.com/errata/RHSA-2026:3962",[114,120,122],[124,178,127],{"url":215,"sources":216,"tags":217},"https://access.redhat.com/errata/RHSA-2026:3960",[114,120,122],[124,178,127],{"url":219,"sources":220,"tags":221},"https://access.redhat.com/errata/RHSA-2026:2694",[114,120,122],[124,178,127],{"url":223,"sources":224,"tags":225},"https://access.redhat.com/errata/RHSA-2026:6291",[114,120,122],[124,178,127],{"url":227,"sources":228,"tags":230},"https://security-tracker.debian.org/tracker/CVE-2026-1312",[229],"osv_debian",[127],{"url":232,"sources":233,"tags":234},"https://github.com/django/django/",[122],[134],{"url":236,"sources":237,"tags":238},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1312.json",[122],[127],{"url":240,"sources":241,"tags":242},"https://pypi.org/project/Django/",[122],[160],[],{"date":245,"score":110,"percentile":246},"2026-09-19",0.56089,[248,252,255,259,261,264,268,270,273,276,279,281,284,287,290,293,295,298,301,303,306,309,312,315,318,320,323,326,329,332,335,337,341,344,347,350,353,356,358,361,364,367,370,373,376,379,382,385,387,390,393,396,399,402,405,408,411,414,417,419,422,425,427,430,432,435,437,440,444,447,450,453,456,459,462,465,468,471,474,477,480,482,485,488,490,493,496,499,501,503],{"date":249,"score":250,"percentile":251},"2026-02-04",0.0001,0.00973,{"date":253,"score":250,"percentile":254},"2026-02-05",0.00877,{"date":256,"score":257,"percentile":258},"2026-02-06",0.00007,0.00494,{"date":260,"score":257,"percentile":258},"2026-02-07",{"date":262,"score":257,"percentile":263},"2026-02-08",0.00491,{"date":265,"score":266,"percentile":267},"2026-02-09",0.00008,0.00601,{"date":269,"score":266,"percentile":267},"2026-02-10",{"date":271,"score":266,"percentile":272},"2026-02-11",0.00615,{"date":274,"score":266,"percentile":275},"2026-02-12",0.00616,{"date":277,"score":266,"percentile":278},"2026-02-13",0.00613,{"date":280,"score":266,"percentile":278},"2026-02-14",{"date":282,"score":266,"percentile":283},"2026-02-15",0.00611,{"date":285,"score":266,"percentile":286},"2026-02-16",0.00608,{"date":288,"score":266,"percentile":289},"2026-02-17",0.00604,{"date":291,"score":266,"percentile":292},"2026-02-18",0.00676,{"date":294,"score":266,"percentile":292},"2026-02-19",{"date":296,"score":266,"percentile":297},"2026-02-20",0.00682,{"date":299,"score":250,"percentile":300},"2026-02-21",0.01143,{"date":302,"score":250,"percentile":300},"2026-02-22",{"date":304,"score":250,"percentile":305},"2026-02-23",0.01114,{"date":307,"score":250,"percentile":308},"2026-02-24",0.01094,{"date":310,"score":250,"percentile":311},"2026-02-25",0.01093,{"date":313,"score":250,"percentile":314},"2026-02-26",0.01084,{"date":316,"score":250,"percentile":317},"2026-02-27",0.01088,{"date":319,"score":250,"percentile":308},"2026-02-28",{"date":321,"score":250,"percentile":322},"2026-03-01",0.01107,{"date":324,"score":250,"percentile":325},"2026-03-02",0.01101,{"date":327,"score":250,"percentile":328},"2026-03-03",0.01124,{"date":330,"score":250,"percentile":331},"2026-03-04",0.0111,{"date":333,"score":250,"percentile":334},"2026-03-05",0.01121,{"date":336,"score":250,"percentile":328},"2026-03-06",{"date":338,"score":339,"percentile":340},"2026-03-07",0.00012,0.01641,{"date":342,"score":339,"percentile":343},"2026-03-08",0.01638,{"date":345,"score":339,"percentile":346},"2026-03-09",0.01628,{"date":348,"score":339,"percentile":349},"2026-03-10",0.01624,{"date":351,"score":339,"percentile":352},"2026-03-11",0.01583,{"date":354,"score":339,"percentile":355},"2026-03-12",0.01591,{"date":357,"score":339,"percentile":352},"2026-03-13",{"date":359,"score":339,"percentile":360},"2026-03-14",0.01545,{"date":362,"score":339,"percentile":363},"2026-03-15",0.01535,{"date":365,"score":339,"percentile":366},"2026-03-16",0.01527,{"date":368,"score":339,"percentile":369},"2026-03-17",0.01498,{"date":371,"score":339,"percentile":372},"2026-03-18",0.01495,{"date":374,"score":339,"percentile":375},"2026-03-19",0.01489,{"date":377,"score":339,"percentile":378},"2026-03-20",0.0149,{"date":380,"score":339,"percentile":381},"2026-03-21",0.01621,{"date":383,"score":339,"percentile":384},"2026-03-22",0.01619,{"date":386,"score":339,"percentile":384},"2026-03-23",{"date":388,"score":339,"percentile":389},"2026-03-24",0.01611,{"date":391,"score":339,"percentile":392},"2026-03-25",0.01606,{"date":394,"score":339,"percentile":395},"2026-03-26",0.01614,{"date":397,"score":339,"percentile":398},"2026-03-27",0.01616,{"date":400,"score":339,"percentile":401},"2026-03-28",0.01617,{"date":403,"score":339,"percentile":404},"2026-03-29",0.01612,{"date":406,"score":250,"percentile":407},"2026-03-30",0.01078,{"date":409,"score":250,"percentile":410},"2026-03-31",0.01063,{"date":412,"score":250,"percentile":413},"2026-04-01",0.01062,{"date":415,"score":250,"percentile":416},"2026-04-02",0.01069,{"date":418,"score":250,"percentile":416},"2026-04-03",{"date":420,"score":250,"percentile":421},"2026-04-04",0.01072,{"date":423,"score":250,"percentile":424},"2026-04-05",0.01071,{"date":426,"score":250,"percentile":407},"2026-04-06",{"date":428,"score":250,"percentile":429},"2026-04-07",0.01079,{"date":431,"score":250,"percentile":314},"2026-04-08",{"date":433,"score":250,"percentile":434},"2026-04-09",0.01083,{"date":436,"score":250,"percentile":429},"2026-04-10",{"date":438,"score":250,"percentile":439},"2026-04-11",0.01067,{"date":441,"score":442,"percentile":443},"2026-04-12",0.00011,0.01443,{"date":445,"score":442,"percentile":446},"2026-04-13",0.01444,{"date":448,"score":442,"percentile":449},"2026-04-14",0.01427,{"date":451,"score":442,"percentile":452},"2026-04-15",0.01423,{"date":454,"score":442,"percentile":455},"2026-04-16",0.01433,{"date":457,"score":442,"percentile":458},"2026-04-17",0.0144,{"date":460,"score":442,"percentile":461},"2026-04-18",0.01446,{"date":463,"score":442,"percentile":464},"2026-04-19",0.01445,{"date":466,"score":442,"percentile":467},"2026-04-20",0.01439,{"date":469,"score":442,"percentile":470},"2026-04-21",0.01534,{"date":472,"score":442,"percentile":473},"2026-04-22",0.0154,{"date":475,"score":442,"percentile":476},"2026-04-23",0.01548,{"date":478,"score":442,"percentile":479},"2026-04-24",0.01541,{"date":481,"score":442,"percentile":479},"2026-04-25",{"date":483,"score":442,"percentile":484},"2026-04-26",0.01539,{"date":486,"score":442,"percentile":487},"2026-04-27",0.01555,{"date":489,"score":442,"percentile":479},"2026-04-28",{"date":491,"score":442,"percentile":492},"2026-04-29",0.01549,{"date":494,"score":442,"percentile":495},"2026-04-30",0.01542,{"date":497,"score":442,"percentile":498},"2026-05-01",0.01537,{"date":500,"score":442,"percentile":470},"2026-05-02",{"date":502,"score":442,"percentile":470},"2026-05-03",{"date":504,"score":442,"percentile":505},"2026-05-04",0.01533,[507,512,514,516,518],{"source":114,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":508,"cvss_v4_0":9},{"baseScore":112,"baseSeverity":509,"vectorString":115,"impactScore":510,"exploitabilityScore":511},"MEDIUM",4.2,7.2,{"source":120,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":513,"cvss_v4_0":9},{"baseScore":112,"baseSeverity":509,"vectorString":115,"impactScore":510,"exploitabilityScore":511},{"source":121,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":515,"cvss_v4_0":9},{"baseScore":112,"baseSeverity":9,"vectorString":115,"impactScore":510,"exploitabilityScore":511},{"source":229,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":517,"cvss_v4_0":9},{"baseScore":112,"baseSeverity":9,"vectorString":115,"impactScore":510,"exploitabilityScore":511},{"source":122,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":519,"cvss_v4_0":9},{"baseScore":112,"baseSeverity":9,"vectorString":115,"impactScore":510,"exploitabilityScore":511},[521,533,537,543,549,567,586],{"ecosystem":522,"name":523,"vendor":524,"product":523,"cpe_part":9,"purl_type":525,"purl_namespace":524,"purl_name":523,"source":9,"versions":526},"Chainguard","authentik","chainguard","apk",[527],{"version":528,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":531,"version_end_type":532,"fixed_in":9},"lt2025_12_1_r2",true,"ecosystem","2025.12.1-r2","excluding",{"ecosystem":522,"name":534,"vendor":524,"product":534,"cpe_part":9,"purl_type":525,"purl_namespace":524,"purl_name":534,"source":9,"versions":535},"authentik-fips",[536],{"version":528,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":531,"version_end_type":532,"fixed_in":9},{"ecosystem":522,"name":538,"vendor":524,"product":538,"cpe_part":9,"purl_type":525,"purl_namespace":524,"purl_name":538,"source":9,"versions":539},"awx",[540],{"version":541,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":542,"version_end_type":532,"fixed_in":9},"lt24_6_1_r27","24.6.1-r27",{"ecosystem":522,"name":544,"vendor":524,"product":544,"cpe_part":9,"purl_type":525,"purl_namespace":524,"purl_name":544,"source":9,"versions":545},"label-studio",[546],{"version":547,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":548,"version_end_type":532,"fixed_in":9},"lt1_22_0_r3","1.22.0-r3",{"ecosystem":550,"name":551,"vendor":552,"product":551,"cpe_part":9,"purl_type":553,"purl_namespace":552,"purl_name":551,"source":9,"versions":554},"Debian","python-django","debian","deb",[555,558,561,564],{"version":556,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":557,"version_end_type":532,"fixed_in":9},"lt2:2_2_28_1~deb11u12","2:2.2.28-1~deb11u12",{"version":559,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":560,"version_end_type":532,"fixed_in":9},"lt3:3_2_25_0+deb12u2","3:3.2.25-0+deb12u2",{"version":562,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":563,"version_end_type":532,"fixed_in":9},"lt3:4_2_28_0+deb13u1","3:4.2.28-0+deb13u1",{"version":565,"is_range":529,"range_type":530,"version_start":9,"version_start_type":9,"version_end":566,"version_end_type":532,"fixed_in":9},"lt3:4_2_28_1","3:4.2.28-1",{"ecosystem":9,"name":568,"vendor":569,"product":568,"cpe_part":570,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":571},"django","djangoproject","a",[572,578,582],{"version":573,"is_range":529,"range_type":574,"version_start":575,"version_start_type":576,"version_end":577,"version_end_type":532,"fixed_in":9},"gte4.2_lt4.2.28","cpe","4.2","including","4.2.28",{"version":579,"is_range":529,"range_type":574,"version_start":580,"version_start_type":576,"version_end":581,"version_end_type":532,"fixed_in":9},"gte5.2_lt5.2.11","5.2","5.2.11",{"version":583,"is_range":529,"range_type":574,"version_start":584,"version_start_type":576,"version_end":585,"version_end_type":532,"fixed_in":9},"gte6.0_lt6.0.2","6.0","6.0.2",{"ecosystem":587,"name":568,"vendor":587,"product":568,"cpe_part":9,"purl_type":588,"purl_namespace":9,"purl_name":568,"source":9,"versions":589},"PyPI","pypi",[590,592,595,598],{"version":591,"is_range":529,"range_type":530,"version_start":584,"version_start_type":576,"version_end":585,"version_end_type":532,"fixed_in":9},"gte6_0_lt6_0_2",{"version":593,"is_range":529,"range_type":530,"version_start":594,"version_start_type":576,"version_end":585,"version_end_type":532,"fixed_in":9},"gte6_0a1_lt6_0_2","6.0a1",{"version":596,"is_range":529,"range_type":530,"version_start":597,"version_start_type":576,"version_end":581,"version_end_type":532,"fixed_in":9},"gte5_2a1_lt5_2_11","5.2a1",{"version":599,"is_range":529,"range_type":530,"version_start":600,"version_start_type":576,"version_end":577,"version_end_type":532,"fixed_in":9},"gte4_2a1_lt4_2_28","4.2a1"]