{"id":"CVE-2026-15307","aliases":["ALPINE-CVE-2026-15307","BIT-django-2026-15307","CLSA-2026-1790832163","CLSA-2026-1790835761","CLSA-2026-1790845039","CLSA-2026-1790845756","CLSA-2026-1790845807","CLSA-2026-1791265304","CLSA-2026-1791271957","CLSA-2026-1791368170","CLSA-2026-1791369358","CLSA-2026-1791371255","DEBIAN-CVE-2026-15307","EUVD-2026-52747","GHSA-wvqv-fj8w-qmhm","MGASA-2026-0339","OESA-2026-3496","OESA-2026-3497","OESA-2026-3498","OESA-2026-3499","PYSEC-2026-4035","RHSA-2026:59135","RHSA-2026:59136","RHSA-2026:59137","ROOT-APP-PYPI-CVE-2026-15307","SUSE-SU-2026:3503-1","UBUNTU-CVE-2026-15307","USN-8848-1","openSUSE-SU-2026:11464-1","openSUSE-SU-2026:11465-1","openSUSE-SU-2026:11491-1","openSUSE-SU-2026:21543-1"],"status":"published","title":"Server-side file-write and request forgery via spatial lookups","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01134,"percentile":0.66748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-73","CWE-918"],"published":"2026-08-04T15:48:18Z","modified":"2026-11-03T06:33:01Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["5.2.17","6.0.8"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["5.2.17-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["5.2.17","6.0.8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:5.2.17-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"django","fixed_in":["4.1.13+aikido.5","2.2.28+aikido.5","3.2.25+aikido.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-django","fixed_in":["2:3.2.12-2ubuntu1.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.18"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-django","fixed_in":["3:5.2.9-0ubuntu4.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0a1"},{"fixed":"6.0.8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.17"},{"introduced":"6.0.0"},{"fixed":"6.0.8"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.10"},{"fixed":"5.1.10.post5+tuxcare"}]}],"versions":["5.1.10","5.1.10.post1+tuxcare","5.1.10.post2+tuxcare","5.1.10.post3+tuxcare","5.1.10.post4+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9"},{"fixed":"5.1.9.post7+tuxcare"}]}],"versions":["5.1.9","5.1.9.post1+tuxcare","5.1.9.post2+tuxcare","5.1.9.post3+tuxcare","5.1.9.post4+tuxcare","5.1.9.post5+tuxcare","5.1.9.post6+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4"},{"fixed":"5.1.4.post8+tuxcare"}]}],"versions":["5.1.4","5.1.4.post1+tuxcare","5.1.4.post2+tuxcare","5.1.4.post3+tuxcare","5.1.4.post4+tuxcare","5.1.4.post5+tuxcare","5.1.4.post6+tuxcare","5.1.4.post7+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.post11+tuxcare"}]}],"versions":["5.1","5.1.post1+tuxcare","5.1.post10+tuxcare","5.1.post2+tuxcare","5.1.post3+tuxcare","5.1.post4+tuxcare","5.1.post5+tuxcare","5.1.post6+tuxcare","5.1.post7+tuxcare","5.1.post8+tuxcare","5.1.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.post16+tuxcare"}]}],"versions":["5.0","5.0.post1+tuxcare","5.0.post10+tuxcare","5.0.post11+tuxcare","5.0.post12+tuxcare","5.0.post13+tuxcare","5.0.post14+tuxcare","5.0.post15+tuxcare","5.0.post2+tuxcare","5.0.post3+tuxcare","5.0.post4+tuxcare","5.0.post5+tuxcare","5.0.post6+tuxcare","5.0.post7+tuxcare","5.0.post8+tuxcare","5.0.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2"},{"fixed":"5.0.2.post11+tuxcare"}]}],"versions":["5.0.2","5.0.2.post1+tuxcare","5.0.2.post10+tuxcare","5.0.2.post2+tuxcare","5.0.2.post3+tuxcare","5.0.2.post4+tuxcare","5.0.2.post5+tuxcare","5.0.2.post6+tuxcare","5.0.2.post7+tuxcare","5.0.2.post8+tuxcare","5.0.2.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1"},{"fixed":"5.0.1.post12+tuxcare"}]}],"versions":["5.0.1","5.0.1.post1+tuxcare","5.0.1.post10+tuxcare","5.0.1.post11+tuxcare","5.0.1.post2+tuxcare","5.0.1.post3+tuxcare","5.0.1.post4+tuxcare","5.0.1.post5+tuxcare","5.0.1.post6+tuxcare","5.0.1.post7+tuxcare","5.0.1.post8+tuxcare","5.0.1.post9+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post14+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post10+tuxcare","4.2.post11+tuxcare","4.2.post12+tuxcare","4.2.post13+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare","4.2.post8+tuxcare","4.2.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.post23+tuxcare"}]}],"versions":["4.0","4.0.post1+tuxcare","4.0.post10+tuxcare","4.0.post11+tuxcare","4.0.post12+tuxcare","4.0.post13+tuxcare","4.0.post14+tuxcare","4.0.post15+tuxcare","4.0.post16+tuxcare","4.0.post17+tuxcare","4.0.post18+tuxcare","4.0.post19+tuxcare","4.0.post2+tuxcare","4.0.post20+tuxcare","4.0.post21+tuxcare","4.0.post22+tuxcare","4.0.post3+tuxcare","4.0.post4+tuxcare","4.0.post5+tuxcare","4.0.post6+tuxcare","4.0.post7+tuxcare","4.0.post8+tuxcare","4.0.post9+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.25"},{"fixed":"3.2.25.post9+tuxcare"}]}],"versions":["3.2.25","3.2.25.post1+tuxcare","3.2.25.post2+tuxcare","3.2.25.post3+tuxcare","3.2.25.post4+tuxcare","3.2.25.post5+tuxcare","3.2.25.post6+tuxcare","3.2.25.post7+tuxcare","3.2.25.post8+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1","3:3.2.25-0+deb12u1","3:3.2.25-0+deb12u2","3:3.2.25-0+deb12u3","3:3.2.25-0+deb12u4","3:3.2.25-0+deb12u5","3:3.2.25-0+deb12u6","3:4.1-1","3:4.1.1-1","3:4.1.2-1","3:4.1.3-1","3:4.1.4-1","3:4.1.5-1","3:4.2-1","3:4.2.1-1","3:4.2.10-1","3:4.2.11-1","3:4.2.13-1","3:4.2.14-1","3:4.2.15-1","3:4.2.15-1~bpo12+1","3:4.2.16-1","3:4.2.17-1","3:4.2.17-2","3:4.2.18-1","3:4.2.18-1~bpo12+1","3:4.2.19-1","3:4.2.19-1~bpo12+1","3:4.2.2-1","3:4.2.20-1","3:4.2.20-1~bpo12+1","3:4.2.21-1","3:4.2.21-1~bpo12+1","3:4.2.22-1","3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.3-1","3:4.2.30-1","3:4.2.4-1","3:4.2.5-1","3:4.2.5-2","3:4.2.6-1","3:4.2.8-1","3:4.2.9-1","3:4.2~alpha1-1","3:4.2~beta1-1","3:4.2~rc1-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.17-2~bpo13+1","3:5.2.18-1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1.1-1","3:6.1.2-1","3:6.1~beta1-1","3:6.1~rc1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-0+deb13u1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-0+deb13u1","3:4.2.28-0+deb13u2","3:4.2.28-1","3:4.2.29-1","3:4.2.30-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.17-1","3:5.2.17-2","3:5.2.17-2~bpo13+1","3:5.2.18-1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1","3:6.0-1","3:6.0.1-1","3:6.0.2-1","3:6.0.3-1","3:6.0.4-1","3:6.0.5-1","3:6.0.6-1","3:6.0~alpha1-1","3:6.0~beta1-1","3:6.0~rc1-1","3:6.1-1","3:6.1.1-1","3:6.1.2-1","3:6.1~beta1-1","3:6.1~rc1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.17-1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1","3:4.2.27-1","3:4.2.27-2","3:4.2.28-1","3:4.2.29-1","3:4.2.30-1","3:5.0-1","3:5.0.1-1","3:5.0.2-1","3:5.0.3-1","3:5.0.4-1","3:5.0.6-1","3:5.0~alpha1-1","3:5.0~rc1-1","3:5.1-1","3:5.1.1-1","3:5.1.2-1","3:5.1.3-1","3:5.1.4-1","3:5.1.5-1","3:5.1~alpha1-1","3:5.1~beta1-1","3:5.1~rc1-1","3:5.2-1","3:5.2.1-1","3:5.2.13-1","3:5.2.14-1","3:5.2.14-2","3:5.2.15-1","3:5.2.15-2","3:5.2.15-2~bpo13+1","3:5.2.16-1","3:5.2.16-1~bpo13+1","3:5.2.2-1","3:5.2.3-1","3:5.2.4-1","3:5.2.5-1","3:5.2.6-1","3:5.2~alpha1-1","3:5.2~beta1-1","3:5.2~rc1-1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.10","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10a1","1.10b1","1.10rc1","1.11","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.2","1.11.20","1.11.21","1.11.22","1.11.23","1.11.24","1.11.25","1.11.26","1.11.27","1.11.28","1.11.29","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11a1","1.11b1","1.11rc1","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1","1.9","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9a1","1.9b1","1.9rc1","1.9rc2","2.0","2.0.1","2.0.10","2.0.12","2.0.13","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0a1","2.0b1","2.0rc1","2.1","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1a1","2.1b1","2.1rc1","2.2","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.27","2.2.28","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.2a1","2.2b1","2.2rc1","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.0a1","3.0b1","3.0rc1","3.1","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.1a1","3.1b1","3.1rc1","3.2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.15","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.20","3.2.21","3.2.22","3.2.23","3.2.24","3.2.25","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.2a1","3.2b1","3.2rc1","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0b1","4.0rc1","4.1","4.1.1","4.1.10","4.1.11","4.1.12","4.1.13","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.1a1","4.1b1","4.1rc1","4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.25","4.2.26","4.2.27","4.2.28","4.2.29","4.2.3","4.2.30","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.2a1","4.2b1","4.2rc1","5.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.0a1","5.0b1","5.0rc1","5.1","5.1.1","5.1.10","5.1.11","5.1.12","5.1.13","5.1.14","5.1.15","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.1a1","5.1b1","5.1rc1","5.2","5.2.1","5.2.10","5.2.11","5.2.12","5.2.13","5.2.14","5.2.15","5.2.16","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.2a1","5.2b1","5.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0a1"},{"fixed":"6.0.8"}]}],"versions":["6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0a1","6.0b1","6.0rc1"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-18.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-18.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-18.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-18.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17"},{"introduced":"6.0a1"},{"fixed":"6.0.8"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.10","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10a1","1.10b1","1.10rc1","1.11","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.2","1.11.20","1.11.21","1.11.22","1.11.23","1.11.24","1.11.25","1.11.26","1.11.27","1.11.28","1.11.29","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11a1","1.11b1","1.11rc1","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.19","1.4.2","1.4.20","1.4.21","1.4.22","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.10","1.6.11","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.10","1.7.11","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.8","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8a1","1.8b1","1.8b2","1.8c1","1.9","1.9.1","1.9.10","1.9.11","1.9.12","1.9.13","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9a1","1.9b1","1.9rc1","1.9rc2","2.0","2.0.1","2.0.10","2.0.12","2.0.13","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0a1","2.0b1","2.0rc1","2.1","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1a1","2.1b1","2.1rc1","2.2","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.27","2.2.28","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.2a1","2.2b1","2.2rc1","3.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.0a1","3.0b1","3.0rc1","3.1","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.1a1","3.1b1","3.1rc1","3.2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.15","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.20","3.2.21","3.2.22","3.2.23","3.2.24","3.2.25","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.2a1","3.2b1","3.2rc1","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0b1","4.0rc1","4.1","4.1.1","4.1.10","4.1.11","4.1.12","4.1.13","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.1a1","4.1b1","4.1rc1","4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.25","4.2.26","4.2.27","4.2.28","4.2.29","4.2.3","4.2.30","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.2a1","4.2b1","4.2rc1","5.0","5.0.1","5.0.10","5.0.11","5.0.12","5.0.13","5.0.14","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.0a1","5.0b1","5.0rc1","5.1","5.1.1","5.1.10","5.1.11","5.1.12","5.1.13","5.1.14","5.1.15","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.1a1","5.1b1","5.1rc1","5.2","5.2.1","5.2.10","5.2.11","5.2.12","5.2.13","5.2.14","5.2.15","5.2.16","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6","5.2.7","5.2.8","5.2.9","5.2a1","5.2b1","5.2rc1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0a1","6.0b1","6.0rc1"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260824-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260824-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.32-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.13-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el10","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el10","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.16-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.16-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.16-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.7::el10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.7::el10","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.7::el10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.7::el10","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el10ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.7::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.7::el9","package":"python3.12-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.17-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.7::el10","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.6-1.el10ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.7::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.8.6-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13+aikido.5"},{"fixed":"2.2.28+aikido.5"},{"fixed":"3.2.25+aikido.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.65.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13","1:1.11.11-1ubuntu1.21+esm14","1:1.11.11-1ubuntu1.21+esm15","1:1.11.11-1ubuntu1.21+esm17"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6","2:2.2.12-1ubuntu0.29+esm7","2:2.2.12-1ubuntu0.29+esm8","2:2.2.12-1ubuntu0.29+esm10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.29"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24","2:3.2.12-2ubuntu1.25","2:3.2.12-2ubuntu1.26","2:3.2.12-2ubuntu1.27"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.18"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13","3:4.2.11-1ubuntu1.14","3:4.2.11-1ubuntu1.15","3:4.2.11-1ubuntu1.16"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.9-0ubuntu4.3"}]}],"versions":["3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu3","3:5.2.9-0ubuntu1","3:5.2.9-0ubuntu2","3:5.2.9-0ubuntu3","3:5.2.9-0ubuntu4","3:5.2.9-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm12"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10","1.6.11-0ubuntu1.3+esm11"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm13"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8","1.8.7-1ubuntu5.15+esm9","1.8.7-1ubuntu5.15+esm10","1.8.7-1ubuntu5.15+esm11","1.8.7-1ubuntu5.15+esm12"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm17"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11","1:1.11.11-1ubuntu1.21+esm12","1:1.11.11-1ubuntu1.21+esm13","1:1.11.11-1ubuntu1.21+esm14","1:1.11.11-1ubuntu1.21+esm15"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm10"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3","2:2.2.12-1ubuntu0.29+esm4","2:2.2.12-1ubuntu0.29+esm5","2:2.2.12-1ubuntu0.29+esm6","2:2.2.12-1ubuntu0.29+esm7","2:2.2.12-1ubuntu0.29+esm8"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.29"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21","2:3.2.12-2ubuntu1.22","2:3.2.12-2ubuntu1.23","2:3.2.12-2ubuntu1.24","2:3.2.12-2ubuntu1.25","2:3.2.12-2ubuntu1.26","2:3.2.12-2ubuntu1.27"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.18"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10","3:4.2.11-1ubuntu1.11","3:4.2.11-1ubuntu1.12","3:4.2.11-1ubuntu1.13","3:4.2.11-1ubuntu1.14","3:4.2.11-1ubuntu1.15","3:4.2.11-1ubuntu1.16"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.9-0ubuntu4.3"}]}],"versions":["3:5.2.4-1ubuntu2","3:5.2.4-1ubuntu3","3:5.2.9-0ubuntu1","3:5.2.9-0ubuntu2","3:5.2.9-0ubuntu3","3:5.2.9-0ubuntu4","3:5.2.9-0ubuntu4.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.8-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.30-5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-bp160.11.1"}]}],"bundled":4}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["vendor-advisory","Patch","Vendor Advisory","advisory","article","report"]},{"url":"https://groups.google.com/g/django-announce","tags":["mailing-list","Mailing List","discussion","article","web","report"]},{"url":"https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520","tags":["patch","Patch","fix","web","article","report"]},{"url":"https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6","tags":["patch","Patch","fix","web","article","report"]},{"url":"https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa","tags":["patch","Patch","fix","web","article","report"]},{"url":"https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e","tags":["patch","Patch","fix","web","article","report"]},{"url":"https://www.djangoproject.com/weblog/2026/aug/04/security-releases/","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15307","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2026/aug/04/security-releases","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wvqv-fj8w-qmhm","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-15307","tags":["advisory"]},{"url":"https://github.com/django/django/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15307.json","tags":["advisory"]},{"url":"https://pypi.org/project/Django/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15307","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0339.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36132","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/04/6","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/5.2.17/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15830","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15920","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3497","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3498","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3499","tags":["advisory"]},{"url":"https://pypi.org/project/django","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59135","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59135.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15307","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39373","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39373","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39373","tags":["advisory"]},{"url":"https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44705","tags":["advisory"]},{"url":"https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52902","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59886","tags":["advisory"]},{"url":"https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4","tags":["article"]},{"url":"https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67324","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-authentication-bypass-via-joined-short-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13017","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13223","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71364","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71364","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71365","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71365","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71365","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71366","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78677","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59136","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488480","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59136.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143","tags":["advisory"]},{"url":"https://cwe.mitre.org/data/definitions/93.html","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229","tags":["article"]},{"url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045","tags":["article"]},{"url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx","tags":["article"]},{"url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data","tags":["article"]},{"url":"https://www.npmjs.com/package/form-data","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44545","tags":["advisory"]},{"url":"https://github.com/django/daphne/blob/main/CHANGELOG.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59137","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59137.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263503-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272997","tags":["report"]},{"url":"https://bugzilla.suse.com/1272998","tags":["report"]},{"url":"https://bugzilla.suse.com/1272999","tags":["report"]},{"url":"https://bugzilla.suse.com/1273000","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15920","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-15307","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8848-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6907","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8404","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15307","title":"Server-side file-write and request forgery via spatial lookups","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T15:48:18.829Z","modified":"2026-08-05T03:57:15.862Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-73","CWE-918"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-52747","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T15:48:18Z","modified":"2026-08-05T03:57:15Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:22.159181Z"}],"ghsa":[{"id":"GHSA-wvqv-fj8w-qmhm","title":"Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T18:31:27Z","modified":"2026-09-30T23:25:48Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-15307","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T17:16:46.127Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-73","CWE-918"],"updated_at":"2026-11-02T14:12:34.643497Z"}],"osv":[{"id":"ALPINE-CVE-2026-15307","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T17:16:46.127Z","modified":"2026-11-03T06:33:01.563054188Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-15307","title":"Server-side file-write and request forgery via spatial lookups","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T15:48:18.829Z","modified":"2026-10-28T02:30:42.216341457Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-73","CWE-918"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-15307","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T17:16:46.127Z","modified":"2026-10-25T09:47:37.775755462Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"GHSA-wvqv-fj8w-qmhm","title":"Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T18:31:27Z","modified":"2026-10-01T17:56:17.845009416Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"OESA-2026-3496","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)","status":"published","published":"2026-08-30T04:14:04Z","modified":"2026-08-30T04:31:44.097675441Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3497","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)","status":"published","published":"2026-08-30T04:14:07Z","modified":"2026-08-30T04:31:30.907771187Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3498","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)","status":"published","published":"2026-08-30T04:14:09Z","modified":"2026-08-30T04:32:36.283715872Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3499","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor\u0026apos;s `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.(CVE-2026-15307)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view, which is not routed by default. The consumed memory is bounded, since request data is limited by the `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of entries.(CVE-2026-15337)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango\u0026apos;s django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text (WKT), well-known binary (WKB), or hex-encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library. Spatial field lookups and the django.contrib.gis.forms.GeometryField form field are also affected. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.(CVE-2026-15830)\n\nAn issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.(CVE-2026-15920)","status":"published","published":"2026-08-30T04:14:12Z","modified":"2026-08-30T04:31:30.911553322Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"PYSEC-2026-4035","title":"Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-10-01T16:38:29.178928Z","modified":"2026-10-01T17:56:17.845009416Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"},{"id":"RHSA-2026:59135","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-08-25T10:23:11Z","modified":"2026-10-20T10:11:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59136","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-08-25T10:23:11Z","modified":"2026-10-20T10:11:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:59137","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update","status":"published","published":"2026-08-25T10:23:12Z","modified":"2026-10-10T10:15:18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-15307","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-04T17:16:00Z","modified":"2026-10-02T12:18:07.34565112Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"BIT-django-2026-15307","title":"Server-side file-write and request forgery via spatial lookups","description":"An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\nGeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.","status":"published","published":"2026-08-19T08:39:50.841Z","modified":"2026-10-01T17:56:17.845009416Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2026-1790832163","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.10.post5+tuxcare.","status":"published","published":"2026-10-01T05:22:43Z","modified":"2026-10-15T09:48:02.351739897Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790835761","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post7+tuxcare.","status":"published","published":"2026-10-01T06:22:41Z","modified":"2026-10-15T09:48:02.333195152Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790845039","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post8+tuxcare.","status":"published","published":"2026-10-01T08:57:19Z","modified":"2026-10-15T09:47:41.965899895Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790845756","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.post11+tuxcare.","status":"published","published":"2026-10-01T09:09:16Z","modified":"2026-10-15T09:47:41.972127251Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790845807","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post16+tuxcare.","status":"published","published":"2026-10-01T09:10:07Z","modified":"2026-10-15T09:47:42.002380958Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791265304","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.2.post11+tuxcare.","status":"published","published":"2026-10-06T05:41:44Z","modified":"2026-10-15T09:46:39.653885956Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791271957","title":"TuxCare security update for django (6 CVEs)","description":"TuxCare rebuilt django to address 6 CVEs. Fixed in 5.0.1.post12+tuxcare.","status":"published","published":"2026-10-06T07:32:37Z","modified":"2026-10-15T09:48:07.210536039Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791368170","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 4.2.post14+tuxcare.","status":"published","published":"2026-10-07T10:16:10Z","modified":"2026-10-15T09:46:21.707954943Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791369358","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post23+tuxcare.","status":"published","published":"2026-10-07T10:35:58Z","modified":"2026-10-15T09:46:21.707155964Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791371255","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 3.2.25.post9+tuxcare.","status":"published","published":"2026-10-07T11:07:35Z","modified":"2026-10-15T09:46:39.654869475Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0339","title":"Updated python-django packages fix security vulnerabilities","description":"CVE-2026-15307: Server-side file-write and request forgery via spatial\nlookups\nCVE-2026-15337: Potential denial-of-service vulnerability in\n`check_for_language()`\nCVE-2026-15830: Potential denial-of-service vulnerability via nested\ngeometry collections\nCVE-2026-15920: Potential cross-site scripting via `URLField` values in\nthe admin\n","status":"published","published":"2026-08-27T19:15:31Z","modified":"2026-08-27T19:30:04.085490761Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11464-1","title":"python313-Django-6.0.8-1.1 on GA media","description":"These are all security issues fixed in the python313-Django-6.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-06T00:00:00Z","modified":"2026-08-07T10:00:24.979728929Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11465-1","title":"python313-Django4-4.2.30-5.1 on GA media","description":"These are all security issues fixed in the python313-Django4-4.2.30-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-06T00:00:00Z","modified":"2026-08-07T10:00:25.034150338Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11491-1","title":"python313-Django5-5.2.17-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-10T00:00:00Z","modified":"2026-08-11T09:15:06.900830588Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21543-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nChanges in python-Django:\n\n- CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997)\n- CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998)\n- CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999)\n- CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000)\n","status":"published","published":"2026-08-06T14:20:58Z","modified":"2026-08-07T18:45:05.427524193Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-CVE-2026-15307","title":"CVE-2026-15307 in django - Patched by Root","description":"Root has patched CVE-2026-15307 in the django package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-13T08:41:15Z","modified":"2026-10-13T09:00:02.862118457Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2026:3503-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997).\n- CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998).\n- CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999).\n- CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000).\n","status":"published","published":"2026-08-05T12:49:57Z","modified":"2026-08-06T11:15:06.521576983Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8848-1","title":"python-django vulnerabilities","description":"Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial\nlookups when processing untrusted input. A remote attacker could possibly\nuse this issue to make outbound network requests, write arbitrary files, or\nexecute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)\n\nAhmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly\ncached requests where the Vary header contained an asterisk. A remote\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2026-6907)\n\nAhmed Badawe discovered that Django did not properly parse Cache-Control\nresponse directives case-insensitively under certain circumstances. A\nremote attacker could possibly use this issue to view sensitive information\nfrom responses that were incorrectly cached. This issue only affected \nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-8404)","status":"published","published":"2026-09-30T08:09:14Z","modified":"2026-10-02T12:26:44.722989258Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}