114217 matches found
CVE-2026-69703 Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...
CVE-2026-69703
CVE-2026-69703 affects Atlas-Livre. An improper access-control flaw in admin controllers (Espace_admin/controleur/) allows unauthenticated users to bypass session guards by sending raw HTTP requests that ignore redirects. The header() redirect is not followed by exit/die, allowing subsequent code...
EUVD-2026-52866
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...
CVE-2026-69703
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...
django-crispy-admin (0.0.6), django-es-utils (>=0.0.3, <=1.0.3) +4 more potentially affected by CVE-2026-15307 via django (1.8.0)
django PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-crispy-admin 0.0.6 - django-es-utils =0.0.3, =0.1.0, =1.0.0, =1.1.3 - teamvault 0.4.1 Source cves: CVE-2026-15307 Source advisory:...
ae-django-utils (0.3.1), django-admin-toolkit (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-15307 via django (4.0.0rc1)
django PYPI version 4.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ae-django-utils 0.3.1 - django-admin-toolkit =0.1.5, =0.4.0a2, =0.1.0, =0.3.1, =0.1.0, =1.1.0, =1.0.0, =1.9.0 Source cves: CVE-2026-15307 Source...
django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2026-15307 via django (1.10.0)
django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
django-crispy-admin (0.0.6), django-es-utils (>=0.0.3, <=1.0.3) +4 more potentially affected by CVE-2026-15830 via django (1.8.0)
django PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-crispy-admin 0.0.6 - django-es-utils =0.0.3, =0.1.0, =1.0.0, =1.1.3 - teamvault 0.4.1 Source cves: CVE-2026-15830 Source advisory:...
alcali (>=2018.3.4, <=2019.2.4.post0), django-acsecure (0.1.3) +12 more potentially affected by CVE-2026-15830 via django (3.0.3)
django PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.4, =0.2.0, =0.1.5.1, =0.0.2, =0.1.1, =0.9.0, =0.1.0.1, =0.4.1, =0.5.1 Source cves: CVE-2026-15830 Source advisory:...
Cross-site Scripting (XSS)
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the displayforfield function. An attacker can execute arbitrary JavaScript code in the context of th...
CVE-2026-58071
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
django-crispy-admin (0.0.6), django-es-utils (>=0.0.3, <=1.0.3) +4 more potentially affected by CVE-2026-15830 via django (1.8.0)
django PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-crispy-admin 0.0.6 - django-es-utils =0.0.3, =0.1.0, =1.0.0, =1.1.3 - teamvault 0.4.1 Source cves: CVE-2026-15830 Source advisory:...
UBUNTU-CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
UBUNTU-CVE-2026-15307
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
CVE-2026-58071
The vulnerability CVE-2026-58071 affects the Veeam Service Provider Console. An unauthenticated attacker can access the proxied appliance API as Portal Administrator during a short window after an administrator session begins. This could expose sensitive API controls to an unauthenticated user wi...
CVE-2026-58071
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...
CVE-2026-58071
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...