CVE-2026-104816

The open source federated social media platform Misskey is vulnerable to Cross-site Scripting (XSS) in its RSS components. Specifically, versions 12.0.0 through 2026.7.0 fail to verify URL schemes for feed item links. An attacker who controls feed content can provide an unsafe-scheme link , leadi...

BIT-DJANGO-2026-15920 Potential cross-site scripting via URLField values in the admin

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...

CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...