https://seclists.org/oss-sec/2026/q2/796: Django CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193, and CVE-2026-48587
Published Jun 3, 2026
·Updated
Affected Software
1 affected component
pypi/django<=6.0.5, <=5.2.14, <=6.1 (pre-release) / main (pre-release)
Frequently Asked Questions
1
What is the severity of CVE-2026-6873?
CVE-2026-6873 is classified as a high severity vulnerability due to the potential for unauthorized access to sensitive data.
2
How do I fix CVE-2026-7666?
To fix CVE-2026-7666, you should upgrade Django to the latest patched version as recommended in the security release announcement.
3
What are the impacts of CVE-2026-8404?
CVE-2026-8404 allows remote attackers to potentially bypass authentication and gain unauthorized access.
4
Is CVE-2026-35193 exploitable without authentication?
Yes, CVE-2026-35193 can be exploited without authentication, making it particularly dangerous for web applications.
5
What versions of Django are affected by CVE-2026-48587?
CVE-2026-48587 affects multiple versions of Django, and users should review the security advisory for specific version details.