CVE-2026-54625
2 advisories.
PyPI/django-cms CVE-2026-54625: medium 4.8, EPSS 0.18%
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Action: Upgrade django-cms to 5.0.8 or later.
pip install django-cms==5.0.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.8 | - |
Fixed versions
| 5.0.8 |
Sources
- osv: GHSA-fwjf-m4qw-9f2x
- https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x
- https://nvd.nist.gov/vuln/detail/CVE-2026-54625
- https://github.com/django-cms/django-cms/pull/8646
- https://github.com/django-cms/django-cms/pull/8647
- https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa
- https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f
- https://github.com/django-cms/django-cms
- https://github.com/django-cms/django-cms/releases/tag/5.0.8
- https://github.com/django-cms/django-cms/releases/tag/5.1.0
CVE-2026-54625 · published · modified · JSON
PyPI/django-cms CVE-2026-54625: medium 4.8, EPSS 0.18%
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Action: Upgrade django-cms to 5.0.8 or later.
pip install django-cms==5.0.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.0.8 | - |
Fixed versions
| 5.0.8 |
Sources
- osv: PYSEC-2026-3824
- https://github.com/django-cms/django-cms/security/advisories/GHSA-fwjf-m4qw-9f2x
- https://nvd.nist.gov/vuln/detail/CVE-2026-54625
- https://github.com/django-cms/django-cms/pull/8646
- https://github.com/django-cms/django-cms/pull/8647
- https://github.com/django-cms/django-cms/commit/8758714b865ffa79c6bcd0e5c503958ea48885aa
- https://github.com/django-cms/django-cms/commit/d5dc1efa18d157445491c4b12c2dd1efd56f439f
- https://github.com/django-cms/django-cms
- https://github.com/django-cms/django-cms/releases/tag/5.0.8
- https://github.com/django-cms/django-cms/releases/tag/5.1.0
- https://pypi.org/project/django-cms
- https://github.com/advisories/GHSA-fwjf-m4qw-9f2x
CVE-2026-54625 · published · modified · JSON