StackRadarChart IndexLive demo

CVE-2026-35193

Low

Advisory

Published 3 Jun 2026In the index since 6 Sept 2026

Severity: Low; worst across findings
CVSS: 3.1; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 16; of 17,781 indexed, latest versions
Container images: 15; deployed by those charts
Fix available: 1 of 1; affected package

Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary

Carried by container images the latest versions of 16 of 17,781 indexed charts deploy, on 15 images.

Affected package	Affected versions	Fixed in	Images
djangopypi	5.2.3, 5.2.7, 5.2.8, 5.2.11+5 more	5.2.15, 6.0.6	15

OSV records: GHSA-qpc8-7fxc-cm4p
Also known as: BIT-django-2026-35193, PYSEC-2026-197

Charts affected

16 by stars

Chart

Latest

Affected images

Radar Score

paperless-ngxalexmorbo-paperless-ngx

1 of 2 See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	django@5.2.7	5.2.15

Open the chart page →

12,037

openvaultopenvault

1 of 2 See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	django@5.2.3	5.2.15

Open the chart page →

6,873

sentry-k8ssentry-k8s

1 of 11 See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	django@5.2.14	5.2.15

Open the chart page →

16,449

qleverzazuko

1 of 2 See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/zazukoians/qlever-ui :v0.10.0	34c7b540a095	django@5.2.12	5.2.15

Open the chart page →

2,900

opencvecfi2017

1 of 7 See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/cfi2017/opencve-web :3.0.0	6961eab190a2	django@5.2.11	5.2.15

Open the chart page →

15,371

adventurelogdjjudas21

1 of 3 See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/seanmorley15/adventurelog-backend :v0.13.0	0250d9cb0d74	django@5.2.13	5.2.15

Open the chart page →

7,459

chiefonboardinghelmforge

1 of 3 See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
chiefonboarding/chiefonboarding :v2.4.1	59bc7aa60fe7	django@5.2.12	5.2.15

Open the chart page →

10,849

ja-shortenerja-shortener

1 of 2 See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
cr0hn/ja-shortener :v0.1.4	14482d0bc4a1	django@5.2.3	5.2.15

Open the chart page →

2,089

paperlessk8s-home-lab-repo

1 of 1 See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	django@5.2.7	5.2.15

Open the chart page →

9,103

authentikkagiso-me

1 of 1 See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	django@5.2.11	5.2.15

Open the chart page →

4,568

paperless-ngxmt190502

1 of 4 See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	django@5.2.7	5.2.15

Open the chart page →

11,950

linkdingpascaliske

1 of 1 See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/sissbruecker/linkding :1.45.0	61b2eb9eed8e	django@6.0	6.0.6

Open the chart page →

3,854

paperless-ngxrtomik-helm-charts

1 of 1 See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	django@5.2.7	5.2.15

Open the chart page →

10,605

tandoorrtomik-helm-charts

1 of 1 See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
vabene1111/recipes :2.3.5	0f8d061895e9	django@5.2.8	5.2.15

Open the chart page →

4,499

safe-config-servicesafe-global

1 of 3 See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
safeglobal/safe-config-service :latest	09a5e495c219	django@6.0.5	6.0.6

Open the chart page →

1,577

safe-stacksafe-global

1 of 9 See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-35193.

Container image	Digest	Package	Fixed in
safeglobal/safe-config-service :latest	09a5e495c219	django@6.0.5	6.0.6

Open the chart page →

19,560

Container images carrying it

15 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
safeglobal/safe-config-service :latest	09a5e495c219	django@6.0.5	6.0.6	2
chiefonboarding/chiefonboarding :v2.4.1	59bc7aa60fe7	django@5.2.12	5.2.15	1
cr0hn/ja-shortener :v0.1.4	14482d0bc4a1	django@5.2.3	5.2.15	1
vabene1111/recipes :2.3.5	0f8d061895e9	django@5.2.8	5.2.15	1
ghcr.io/cfi2017/opencve-web :3.0.0	6961eab190a2	django@5.2.11	5.2.15	1
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	django@5.2.14	5.2.15	1
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	django@5.2.11	5.2.15	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	django@5.2.7	5.2.15	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	django@5.2.7	5.2.15	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	django@5.2.7	5.2.15	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	django@5.2.7	5.2.15	1
ghcr.io/seanmorley15/adventurelog-backend :v0.13.0	0250d9cb0d74	django@5.2.13	5.2.15	1
ghcr.io/sissbruecker/linkding :1.45.0	61b2eb9eed8e	django@6.0	6.0.6	1
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	django@5.2.3	5.2.15	1
ghcr.io/zazukoians/qlever-ui :v0.10.0	34c7b540a095	django@5.2.12	5.2.15	1