Django

Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920)

Django’s admin auto-linked URLField values without validating the scheme — a stored javascript: value rendered as a live link. Fixed in 6.0.8 and 5.2.17.