django-anymail (pypi) has 2 known vulnerabilities, the worst rated CRITICAL. Upgrade to 1.4 or later to clear all of them. No malicious-package signal is recorded.
No published models are known to use this package.
CVSS v3.0 base score out of 10; GitHub rates it CRITICAL
chance of exploitation in 30 days, 69th percentile of all CVEs
CyberXYZ composite out of 10
fig. 01 — GHSA-qh9x-mc42-vg4g, the advisory selected below
Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An…
Full advisory text at GitHub advisory or NVD.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CyberXYZ does not call a package safe in absolute terms. It records 2 known vulnerabilities for django-anymail (pypi), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Yes. CyberXYZ records 2 known vulnerabilities for django-anymail (pypi), the worst rated CRITICAL. They are GHSA-qh9x-mc42-vg4g, GHSA-hxf9-7h4c-f5jv.
1.4 or later clears every advisory recorded for django-anymail (pypi). Check the release you pick before installing it.
Search django-anymail in CyberXYZ Check at https://cyberxyz.io/check?q=django-anymail. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 13:36 UTC. The most recent advisory here was published 2022-05-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.