Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099482)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099482 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control respon...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099492)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099492 advisory. An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.http.HttpRequest.getsignedcookie in Django uses a non-injective salt derivation...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099460 advisory. An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitab...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099500)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099500 advisory. An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099457 advisory. An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099473)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099473 advisory. An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099506 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099532)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099532 advisory. An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but SESSIONSAVEEVERYREQUEST ...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099501)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099501 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.utils.cache.hasvaryheader in Django does not strip leading or trailing whitespace fr...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099481)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099481 advisory. An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a...

CLSA-2026-1786692826 TuxCare security update for django (5 CVEs)

TuxCare rebuilt django to address 5 CVEs. Fixed in 4.2.post3+tuxcare...

SUSE CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

SUSE CVE-2026-73229

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

PT-2026-80163

TuxCare rebuilt django to address 5 CVEs. Fixed in 4.2.post3+tuxcare...

Cross-site Scripting (XSS)

Overview django-helpdesk is a Django-powered ticket tracker for your helpdesk Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of HTML-formatted email messages or .html/.htm file attachments in public ticket submission channels. An attacker can execute...

CVE-2026-73531

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

EUVD-2026-58243

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...

CVE-2026-73531

The CVE concerns django-helpdesk prior to 2.3.3, where a stored XSS vulnerability exists via HTML attachments or HTML-formatted emails submitted through public ticket channels. The root cause is insufficient sanitization and insecure Content-Disposition handling at the attachment-serving layer, e...

CVE-2026-73531 django-helpdesk < 2.3.3 Stored XSS via HTML Attachments

django-helpdesk before 2.3.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by submitting HTML-formatted email messages or uploading .html/.htm file attachments through public ticket submission channels. Attackers can...