Are you basing this on how often the vulnerabilities get reported and upvoted on HN?

http://www.hnsearch.com/search#request/submissions&q=dja...

Django has had its fair share of patches. This is no reflection on the quality of the project, as it shouldn't be for any sufficiently complicated framework (like Rails).

I also think the vulnerabilities are similar enough to suggest that the first one gave valid reason to ensure the same issue doesn't occur elsewhere. Rather than dusting these issues under the rug or silently fixing them, they're being responsibly reported with patches and updates provided at the same time.

This doesn't seem like broken process to me.