CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

CVE-2026-69117

CVE-2026-69117 : NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH re...

CVE-2026-69117 NetBox 4.5.8 ORM Injection via WritableNestedSerializer

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

python313-Django5-5.2.17-1.1 on GA media (moderate)

python313-Django5-5.2.17-1.1 on GA media Announcement ID: openSUSE-SU-2026:11491-1 Rating: moderate Cross-References: CVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920 CVSS scores: CVE-2026-15307 SUSE : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2026-15307 SUSE : 9.3...

PT-2026-70881

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest framework/renderers.py AdminRenderer.render uses override method to simulate GET and directly invokes view.get without view.check permissions while rendering an invalid...

PT-2026-70880

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest framework/request.py Request. parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded...

PT-2026-70842

NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any RES...

OPENSUSE-SU-2026:11491-1 python313-Django5-5.2.17-1.1 on GA media

These are all security issues fixed in the python313-Django5-5.2.17-1.1 package on the GA media of openSUSE Tumbleweed...

python313-Django4-4.2.30-5.1 on GA media (moderate)

python313-Django4-4.2.30-5.1 on GA media Announcement ID: openSUSE-SU-2026:11465-1 Rating: moderate Cross-References: CVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920 CVSS scores: CVE-2026-15307 SUSE : 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2026-15307 SUSE : 9.3...

CLSA-2026-1786021276 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post8+tuxcare...

SUSE CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

SUSE CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

SUSE CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:3503-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3503-1 advisory. - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. - CVE-2026-15337: potential denial-of-service...

OPENSUSE-SU-2026:11464-1 python313-Django-6.0.8-1.1 on GA media

These are all security issues fixed in the python313-Django-6.0.8-1.1 package on the GA media of openSUSE Tumbleweed...

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant...

Security update for python-Django

This update for python-Django fixes the following issues: CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997. CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998. CVE-2026-15830: potential denial-of-service vulnerability...

CVE-2026-71239

DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...

CVE-2026-71240

DjangoCRM exposes a vulnerability in the toggle_default_sorting view: it is the sole route in common/urls.py not wrapped by login_required or staff_member_required. The handler redirects to a caller-supplied next_url GET parameter after only validating secure_url(next_url) (which checks host agai...

CVE-2026-71239

DjangoCRM: Mass Mail rendering flaw in three code paths (message_previews.py, email_creators.py, helpers.py) uses Django Template() on user-controlled EmlMessage fields without sanitization. This enables authenticated users with mass-mail edit rights to inject Django template syntax ({{ }}, {% %}...