CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CLSA-2025-1761696690 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post6+tuxcare...

CLSA-2025-1756944687 TuxCare security update for django (3 CVEs)

TuxCare rebuilt django to address 3 CVEs. Fixed in 4.0.post3+tuxcare...

CLSA-2026-1768263084 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 3.2.25.post2+tuxcare...

CLSA-2025-1759450296 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.post5+tuxcare...

CLSA-2025-1753747897 TuxCare security update for django (4 CVEs)

TuxCare rebuilt django to address 4 CVEs. Fixed in 5.0.1.post1+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-15920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links ...

Linux Distros Unpatched Vulnerability : CVE-2026-15337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service...

Linux Distros Unpatched Vulnerability : CVE-2026-15307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster b...

Linux Distros Unpatched Vulnerability : CVE-2026-15830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential...

[SECURITY] Fedora 43 Update: python-django5-5.2.16-1.fc43

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora 43 : python-django5 (2026-fbb9501b22)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbb9501b22 advisory. Update python-django5 to version 5.2.16 Fixes three low-severity CVEs - CVE-2026-48588: Potential exposure of private data via cached Set-Cookie...

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware() function in the Django web application framework allows attackers to disclose sensitive information that should be protected.

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware middleware in the Django web application framework is related to improper handling of registrations. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this middleware...

The vulnerability of the `django.http.HttpRequest.get_signed_cookie()` function in the Django web application framework allows a hacker to disclose protected information.

The vulnerability of the django.http.HttpRequest.getsignedcookie function in the Django web application framework is related to errors in checking the cryptographic signature. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this mechani...

The vulnerability of the `django.utils.cache.has_vary_header()` function in the Django web application framework allows attackers to disclose sensitive information that should be protected.

The vulnerability of the django.utils.cache.hasvaryheader function in the Django web application framework is related to incomplete comparisons with missing factors. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

The vulnerability of the django.core.mail.backends.smtp.EmailBackend() function in the Django web application framework allows a hacker to disclose protected information.

The vulnerability of the django.core.mail.backends.smtp.EmailBackend function in the Django web application framework involves the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

CVE-2026-64821

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...