CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CLSA-2026-1768263084 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 3.2.25.post2+tuxcare...

CLSA-2025-1761696690 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post6+tuxcare...

CLSA-2025-1759450296 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.post5+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-15920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links ...

Linux Distros Unpatched Vulnerability : CVE-2026-15337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service...

Linux Distros Unpatched Vulnerability : CVE-2026-15830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential...

Linux Distros Unpatched Vulnerability : CVE-2026-15307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster b...

[SECURITY] Fedora 43 Update: python-django5-5.2.16-1.fc43

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora 43 : python-django5 (2026-fbb9501b22)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbb9501b22 advisory. Update python-django5 to version 5.2.16 Fixes three low-severity CVEs - CVE-2026-48588: Potential exposure of private data via cached Set-Cookie...

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware() function in the Django web application framework allows attackers to disclose sensitive information that should be protected.

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware middleware in the Django web application framework is related to improper handling of registrations. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this middleware...

The vulnerability of the `django.http.HttpRequest.get_signed_cookie()` function in the Django web application framework allows a hacker to disclose protected information.

The vulnerability of the django.http.HttpRequest.getsignedcookie function in the Django web application framework is related to errors in checking the cryptographic signature. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this mechani...

The vulnerability of the `django.utils.cache.has_vary_header()` function in the Django web application framework allows attackers to disclose sensitive information that should be protected.

The vulnerability of the django.utils.cache.hasvaryheader function in the Django web application framework is related to incomplete comparisons with missing factors. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

CVE-2026-64821

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

SUSE CVE-2026-16206

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function loadidtoken of the file oauth2provider/oauth2validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the...

OESA-2026-3078 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3075 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...

OESA-2026-3076 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming reque...