[UPDATE] [hoch] Django: Mehrere Schwachstellen

highCVE-2026-15307 CVE-2026-15337 CVE-2026-15830 CVE-2026-15920

Ein Angreifer kann mehrere Schwachstellen in Django ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial-of-Service-Zustand auszulösen.

CSIRTS triage

vendor: Django product: Django Remote code execution Code injection Cross-site scripting Denial of service

What: Multiple vulnerabilities in Django enable arbitrary code execution, data manipulation, cross-site scripting, and denial of service.
Who is affected: Any application running vulnerable Django versions and handling untrusted input is affected.
Urgency: High severity with multiple attack vectors including code execution requires immediate patching regardless of deployment exposure.
Action: Update Django to the latest patched version without delay.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Django

Get an email when a new Django advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-09-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2649

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-153070.90% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 57% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-153371.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-158301.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-159200.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15307	coverage & exploitation status	NVD · CVE.org
CVE-2026-15337	coverage & exploitation status	NVD · CVE.org
CVE-2026-15830	coverage & exploitation status	NVD · CVE.org
CVE-2026-15920	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Django

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumGHSA-2m8g-3cmr-wg3w: Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when pars…ghsa · 2026-09-01
mediumGHSA-g47c-3xmw-q6m2: Django REST framework: AdminRenderer may disclose GET-protected data when rendering inval…ghsa · 2026-09-01
mediumCVE-2026-82835: A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects…nvd · 2026-08-31
highCVE-2026-55571: djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powe…nvd · 2026-08-25
medium[NEW] [medium] Django: Multiple Vulnerabilitiescert-bund · 2026-08-25
mediumCVE-2026-55468: Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, …nvd · 2026-08-24