be careful not to confuse Django the framework (which is not a cms) with Django-CMS the cms built on top of Django the framework by a different set of people. I cannot comment on the security of django-cms because I didn't look into it but Django the framework tends to be "secure by default" i.e. has defaults that enforce csrf protection and other security best practices.

Django takes security extremely seriously: https://docs.djangoproject.com/en/1.9/topics/security/.

Any Django application that follows good practices and doesn't do anything daft will inherit those security benefits.

Django doesn't permit overwriting of its own program files for update procedures, for example, which some systems to.

(A CMS is by nature slightly more vulnerable, because of the potential for mishandling user-submitted content.)