[UPDATE] [medium] Django: Multiple vulnerabilities

mediumCVE-2024-41989 CVE-2024-41990 CVE-2024-41991 CVE-2024-42005

A remote, anonymous attacker can exploit multiple vulnerabilities in Django to conduct a denial of service attack, manipulate files, and disclose confidential information.

CSIRTS triage

vendor: Django product: Django Denial of serviceOtherInformation disclosure

What: Multiple vulnerabilities allow a remote, anonymous attacker to conduct a denial of service attack, manipulate files, and disclose confidential information.
Who is affected: Deployments of Django are affected.
Urgency: Remediation is medium urgency due to the potential for service disruption and data exposure.
Action: Apply the latest patches to mitigate the vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Django

Get an email when a new Django advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-07-14
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1775

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2024-419891.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all scored CVEs.
Moderate exploitation riskCVE-2024-419901.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all scored CVEs.
Low exploitation riskCVE-2024-419910.95% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 58% of all scored CVEs.
Moderate exploitation riskCVE-2024-420051.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-41989	coverage & exploitation status	NVD · CVE.org
CVE-2024-41990	coverage & exploitation status	NVD · CVE.org
CVE-2024-41991	coverage & exploitation status	NVD · CVE.org
CVE-2024-42005	coverage & exploitation status	NVD · CVE.org

Recent advisories for Django

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-16216: A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown fun…nvd · 2026-07-19
mediumCVE-2026-16215: A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unkno…nvd · 2026-07-19
mediumCVE-2026-16214: A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown fu…nvd · 2026-07-19
lowCVE-2026-16213: A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by t…nvd · 2026-07-19
mediumCVE-2026-16212: A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown funct…nvd · 2026-07-19
mediumCVE-2026-16208: A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function Ca…nvd · 2026-07-19