[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-15920":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":31,"aliases":32,"duplicate_of":9,"upstream":35,"downstream":36,"duplicates":49,"related":50,"reserved_at":9,"published_at":56,"modified_at":57,"state":58,"summary":59,"references_raw":68,"kevs":117,"epss":118,"epss_history":121,"metrics":259,"affected":277},"CVE-2026-15920","An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-83","Improper Neutralization of Script in Attributes in a Web Page","The product does not neutralize or incorrectly neutralizes \"javascript:\" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.","weakness","Draft","Variant",[19,23,27],{"id":20,"name":21,"techniques":22},"CAPEC-243","XSS Targeting HTML Attributes",[],{"id":24,"name":25,"techniques":26},"CAPEC-244","XSS Targeting URI Placeholders",[],{"id":28,"name":29,"techniques":30},"CAPEC-588","DOM-Based XSS",[],[],[33,34],"UBUNTU-CVE-2026-15920","DEBIAN-CVE-2026-15920",[],[37,39,41,43,45,47],{"_key":38},"SUSE-SU-2026:3503-1",{"_key":40},"OPENSUSE-SU-2026:11464-1",{"_key":42},"OPENSUSE-SU-2026:11465-1",{"_key":44},"OPENSUSE-SU-2026:11491-1",{"_key":46},"OPENSUSE-SU-2026:21543-1",{"_key":48},"MGASA-2026-0339",[],[51,52,53,54,55],{"_key":38},{"_key":40},{"_key":42},{"_key":44},{"_key":46},"2026-08-04T15:48:40.537Z","2026-08-04T17:21:13.428Z","Analyzed",{"cisa_kev":60,"cisa_ransomware":60,"cisa_vendor":9,"epss_severity":61,"epss_score":62,"severity":63,"severity_score":64,"severity_version":65,"severity_source":66,"severity_vector":67,"severity_status":58},false,"low",0.00393,"medium",6.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",[69,78,83,87,91,95,99,103,107,111],{"url":70,"sources":71,"tags":74},"https://docs.djangoproject.com/en/dev/releases/security/",[66,72,73],"nvd","osv_ubuntu",[75,76,77],"Vendor Advisory","REPORT","Patch",{"url":79,"sources":80,"tags":81},"https://groups.google.com/g/django-announce",[66,72,73],[82,76],"Mailing List",{"url":84,"sources":85,"tags":86},"https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d",[66,72,73],[77,76],{"url":88,"sources":89,"tags":90},"https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a",[66,72,73],[77,76],{"url":92,"sources":93,"tags":94},"https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b",[66,72,73],[77,76],{"url":96,"sources":97,"tags":98},"https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349",[66,72,73],[77,76],{"url":100,"sources":101,"tags":102},"https://www.djangoproject.com/weblog/2026/aug/04/security-releases/",[66,72,73],[75,76],{"url":104,"sources":105,"tags":106},"https://ubuntu.com/security/CVE-2026-15920",[73],[76],{"url":108,"sources":109,"tags":110},"https://www.cve.org/CVERecord?id=CVE-2026-15920",[73],[76],{"url":112,"sources":113,"tags":115},"https://security-tracker.debian.org/tracker/CVE-2026-15920",[114],"osv_debian",[116],"Advisory",[],{"date":119,"score":62,"percentile":120},"2026-09-19",0.33292,[122,126,129,132,135,138,141,144,147,150,153,156,159,162,165,168,171,174,177,180,183,186,189,192,195,198,201,204,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,252,255,258],{"date":123,"score":124,"percentile":125},"2026-08-05",0.00304,0.22658,{"date":127,"score":124,"percentile":128},"2026-08-06",0.22666,{"date":130,"score":124,"percentile":131},"2026-08-07",0.22684,{"date":133,"score":124,"percentile":134},"2026-08-08",0.2268,{"date":136,"score":124,"percentile":137},"2026-08-09",0.22671,{"date":139,"score":124,"percentile":140},"2026-08-10",0.22683,{"date":142,"score":124,"percentile":143},"2026-08-11",0.22778,{"date":145,"score":124,"percentile":146},"2026-08-12",0.22817,{"date":148,"score":124,"percentile":149},"2026-08-13",0.22842,{"date":151,"score":124,"percentile":152},"2026-08-14",0.22874,{"date":154,"score":124,"percentile":155},"2026-08-15",0.23028,{"date":157,"score":124,"percentile":158},"2026-08-16",0.2304,{"date":160,"score":124,"percentile":161},"2026-08-17",0.22953,{"date":163,"score":124,"percentile":164},"2026-08-18",0.22973,{"date":166,"score":124,"percentile":167},"2026-08-19",0.23068,{"date":169,"score":124,"percentile":170},"2026-08-20",0.23111,{"date":172,"score":124,"percentile":173},"2026-08-21",0.23146,{"date":175,"score":124,"percentile":176},"2026-08-22",0.23148,{"date":178,"score":124,"percentile":179},"2026-08-23",0.23122,{"date":181,"score":62,"percentile":182},"2026-08-24",0.32088,{"date":184,"score":62,"percentile":185},"2026-08-25",0.32113,{"date":187,"score":62,"percentile":188},"2026-08-26",0.32201,{"date":190,"score":62,"percentile":191},"2026-08-27",0.32232,{"date":193,"score":62,"percentile":194},"2026-08-28",0.32217,{"date":196,"score":62,"percentile":197},"2026-08-29",0.3226,{"date":199,"score":62,"percentile":200},"2026-08-30",0.32334,{"date":202,"score":62,"percentile":203},"2026-08-31",0.32338,{"date":205,"score":62,"percentile":206},"2026-09-01",0.32366,{"date":208,"score":62,"percentile":209},"2026-09-02",0.32416,{"date":211,"score":62,"percentile":212},"2026-09-03",0.32443,{"date":214,"score":62,"percentile":215},"2026-09-04",0.32477,{"date":217,"score":62,"percentile":218},"2026-09-05",0.32463,{"date":220,"score":62,"percentile":221},"2026-09-06",0.32539,{"date":223,"score":62,"percentile":224},"2026-09-07",0.32546,{"date":226,"score":62,"percentile":227},"2026-09-08",0.32558,{"date":229,"score":62,"percentile":230},"2026-09-09",0.32709,{"date":232,"score":62,"percentile":233},"2026-09-10",0.32723,{"date":235,"score":62,"percentile":236},"2026-09-11",0.32746,{"date":238,"score":62,"percentile":239},"2026-09-12",0.32844,{"date":241,"score":62,"percentile":242},"2026-09-13",0.32805,{"date":244,"score":62,"percentile":245},"2026-09-14",0.32827,{"date":247,"score":62,"percentile":248},"2026-09-15",0.329,{"date":250,"score":62,"percentile":251},"2026-09-16",0.33061,{"date":253,"score":62,"percentile":254},"2026-09-17",0.3313,{"date":256,"score":62,"percentile":257},"2026-09-18",0.33275,{"date":119,"score":62,"percentile":120},[260,268,272,275],{"source":66,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":261,"cvss_v4_0":265},{"baseScore":64,"baseSeverity":262,"vectorString":67,"impactScore":263,"exploitabilityScore":264},"MEDIUM",4.5,7.2,{"baseScore":266,"baseSeverity":262,"vectorString":267,"impactScore":9,"exploitabilityScore":9},5.1,"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",{"source":72,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":269,"cvss_v4_0":270},{"baseScore":64,"baseSeverity":262,"vectorString":67,"impactScore":263,"exploitabilityScore":264},{"baseScore":266,"baseSeverity":262,"vectorString":271,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":73,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":273,"cvss_v4_0":274},{"baseScore":64,"baseSeverity":9,"vectorString":67,"impactScore":263,"exploitabilityScore":264},{"baseScore":266,"baseSeverity":9,"vectorString":267,"impactScore":9,"exploitabilityScore":9},{"source":114,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":276},{"baseScore":266,"baseSeverity":9,"vectorString":271,"impactScore":9,"exploitabilityScore":9},[278,299,307],{"ecosystem":279,"name":280,"vendor":281,"product":280,"cpe_part":9,"purl_type":282,"purl_namespace":281,"purl_name":280,"source":9,"versions":283},"Debian","python-django","debian","deb",[284,288,292,295,296],{"version":285,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":289,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":290,"version_end_type":291,"fixed_in":9},"lt2:2_2_28_1~deb11u13","2:2.2.28-1~deb11u13","excluding",{"version":293,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":294,"version_end_type":291,"fixed_in":9},"lt3:3_2_25_0+deb12u4","3:3.2.25-0+deb12u4",{"version":285,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":297,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":298,"version_end_type":291,"fixed_in":9},"lt3:5_2_17_1","3:5.2.17-1",{"ecosystem":300,"name":280,"vendor":301,"product":280,"cpe_part":9,"purl_type":282,"purl_namespace":301,"purl_name":280,"source":9,"versions":302},"Ubuntu","ubuntu",[303,304,305,306],{"version":285,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":285,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":285,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":285,"is_range":286,"range_type":287,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":308,"vendor":309,"product":308,"cpe_part":310,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":311},"django","djangoproject","a",[312,318],{"version":313,"is_range":286,"range_type":314,"version_start":315,"version_start_type":316,"version_end":317,"version_end_type":291,"fixed_in":9},"gte5.2_lt5.2.17","cpe","5.2","including","5.2.17",{"version":319,"is_range":286,"range_type":314,"version_start":320,"version_start_type":316,"version_end":321,"version_end_type":291,"fixed_in":9},"gte6.0_lt6.0.8","6.0","6.0.8"]