onyx --cves cve-2026-15920
CVE-2026-15920
- score
- 0.1
- cvss
- 6.1
- epss
- 0.4%
- published
- 2026-08-04
- kev added
- —
- first seen
Django 5.2 < 5.2.17 and 6.0 < 6.0.8 contain a stored XSS caused by unsafe URL schemes rendered as clickable links in django.contrib.admin.utils.display_for_field(), letting attackers execute scripts against staff users, exploit requires unsafe URL values stored in the database.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 7
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b
- https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d
- https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a
- https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/aug/04/security-releases/