BIT-DJANGO-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

[SECURITY] [DLA 4736-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 12, 2026 https://wiki.debian.org/LTS -...

python313-Django5-5.2.17-1.1 on GA media (moderate)

python313-Django5-5.2.17-1.1 on GA media Announcement ID: openSUSE-SU-2026:11491-1 Rating: moderate Cross-References: CVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920 CVSS scores: CVE-2026-15307 SUSE : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2026-15307 SUSE : 9.3...

SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:3503-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3503-1 advisory. - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. - CVE-2026-15337: potential denial-of-service...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +74 more potentially affected by CVE-2026-15920 via django (>=5.2.0, <=5.2.16)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-15920 Source advisory: SNYK:PYTHON-DJANGO-18532968...

arches (8.0.0a1), avaintegration-metapackage (>=6.0.4.3, <=6.0.5.36) +51 more potentially affected by CVE-2026-15920 via django (>=6.0.0a1, <=6.0.7)

django PYPI version =6.0.0a1, =6.0.4.3, =3.1.0, =2.0.0, =1.1.0, =1.2.1 and more Source cves: CVE-2026-15920 Source advisory: SNYK:PYTHON-DJANGO-18532968...

CVE-2026-15920

creationtimestamp| type| source ---|---|--- 2026-08-04 16:29:42+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy 2026-08-05 14:43:12+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3msdr7aekni2v 2026-08-05 14:54:36+00:00| seen|...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +74 more potentially affected by CVE-2026-15920 via django (>=5.2.0, <=5.2.16)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-15920 Source advisory: MEND:CVE-2026-15920...

Linux Distros Unpatched Vulnerability : CVE-2026-15920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links ...