Django

XSpeeder SXZOS Pre-Auth eval() Remote Code Execution (CVE-2025-54322) new EPSS 15%CVE-2025-54322networkCRITICAL 10Unpatched2026-07-06Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459) new EPSS 19%CVE-2025-64459webCRITICAL 9.1Patched2026-07-06Tandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964) newCVE-2026-25964webMEDIUM 4.9Patched2026-07-05Django MultiPartParser Base64 Whitespace CPU Amplification DoS — CVE-2026-33033 newCVE-2026-33033webMEDIUMPatched2026-07-05Django GIS RasterField SQL Injection (CVE-2026-1207) new EPSS 13%CVE-2026-1207webHIGHPatched2026-07-05