... tacks by restricting the sources from which content can be loaded. It plays an important role in a comprehensive security strategy . For configuration instructions in a Django project, see the Using CSP documentation. For an HTTP guide about CS ... P, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking conten ... t that violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing. Each policy is composed ... ... tacks by restricting the sources from which content can be loaded. It plays an important role in a comprehensive security strategy . For configuration instructions in a Django project, see the Using CSP documentation. For an HTTP guide about CS ... P, see the MDN Guide on CSP . 概要 ¶ The Content-Security-Policy specification defines two complementary headers: Content-Security-Policy : Enforces the CSP policy, blocking conten ... t that violates the defined directives. Content-Security-Policy-Report-Only : Reports CSP violations without blocking content, allowing for non-intrusive testing. Each policy is composed ... ... derate", and one security issue with severity "low" in 4.2.27. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... ... derate", and one security issue with severity "low" in 5.2.10. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... ... derate", and one security issue with severity "low" in 4.2.27. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... ... derate", and one security issue with severity "low" in 5.2.10. CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentica ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... ... SGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores. Under W ... t , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not va ... submission of forged POST data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allo ... ... SGI conventions, mapping hyphens to underscores. As a result, even in configurations where reverse proxies carefully strip security-sensitive headers named with hyphens, such a header could be spoofed by supplying a header named with underscores. Under W ... t , matching the behavior of Daphne , the reference server for ASGI. This issue has severity "low" according to the Django security policy . CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin ¶ Add permissions on inline model instances were not va ... submission of forged POST data in GenericInlineModelAdmin . This issue has severity "low" according to the Django security policy . CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable ¶ Admin changelist forms using list_editable incorrectly allo ... ... rate", one security issue with severity "low", and several bugs in 6.0.1. CVE-2025-13473: Username enumeration through timing difference in mo ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... ... rate", one security issue with severity "low", and several bugs in 6.0.1. CVE-2025-13473: Username enumeration through timing difference in mo ... sgi allowed remote attackers to enumerate users via a timing attack. This issue has severity "low" according to the Django security policy . CVE-2025-14550: Potential denial-of-service vulnerability via repeated headers when using ASGI ¶ When receiving d ... omputation resulting in service degradation or outage. This issue has severity "moderate" according to the Django security policy . CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS ¶ Raster lookups on GIS fields (only implemented on ... 2026年10月08日