{"vulnerability": "CVE-2026-15307", "sightings": [{"uuid": "18a828a8-5f66-411f-b45a-78f44594858c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/h5c2dvuor5uzy", "content": "Django CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920", "creation_timestamp": "2026-08-04T16:29:42.247216Z"}, {"uuid": "92af7a49-534d-497f-b0de-d8c1a29479c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3msbrxt7kt622", "content": "GeoDjango\u306f\u3001\u7a7a\u9593\u30eb\u30c3\u30af\u30a2\u30c3\u30d7\u3067\u4e0d\u6b63\u306a\u5165\u529b\u3092\u51e6\u7406\u3059\u308b\u969b\u3001\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u66f8\u304d\u8fbc\u307f\u3001\u5916\u90e8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u767a\u751f\u3055\u305b\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u7e4b\u304c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002GeometryField\u2026\nCVE-2026-15307 CVSS 8.8 | HIGH", "creation_timestamp": "2026-08-04T19:51:38.007228Z"}, {"uuid": "98bca2f7-7ea3-4bf3-81fe-45305a9e0114", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://t.me/CyberDispatch/2485", "content": "Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.", "creation_timestamp": "2026-08-30T00:00:37.808104Z"}, {"uuid": "8b2161c0-880f-476e-b018-ef89d0ba15d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mschtyhb6f2n", "content": "A high-severity Django vulnerability, CVE-2026-15307, can enable remote code execution through spatial lookups. Update to Django 6.0.8 or 5.2.17 now.\n\n#Django #DjangoSecurity #CVE202615307 #RCE #RemoteCodeExecution #Vulnerability #Python #WebSecurity #InfoSec #CyberSecurity", "creation_timestamp": "2026-08-05T02:23:12.479350Z"}, {"uuid": "c36580b8-5231-4723-9ebc-ba5d64cbd200", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mscpueke5k2o", "content": "Top 3 CVE for last 7 days:\nCVE-2026-66066: 42 interactions\nCVE-2026-18577: 32 interactions\nCVE-2026-58048: 15 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-58048: 15 interactions\nCVE-2026-18574: 8 interactions\nCVE-2026-15307: 6 interactions\n", "creation_timestamp": "2026-08-05T04:46:34.989582Z"}, {"uuid": "b47e67b4-dad4-46a8-aafe-b5da05be9e77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mscu3e5ym62o", "content": "CVE-2026-15307 - python-django\nA critical vulnerability in Debian Linux allows an attacker to execute malicious code on a system without being authenticated. This could potentially allow an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pythondjango #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-05T06:02:03.724695Z"}, {"uuid": "4e2e3a66-9539-4a5a-9efd-3c804e32f230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-05T15:00:06.113276Z"}, {"uuid": "65ac5574-5613-4269-9a30-c2a0ec07e2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-06T00:00:33.871682Z"}, {"uuid": "264995dc-aac5-4d10-81e3-4f2bd4eb8d2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtk5p7prtq2i", "content": "\ud83d\udea8 CVE-2026-15307 (High) affects Django 5.2.x before 5.2.17 and 6.0.x before 6.0.8. \n\nGeoDjango passes spatial lookup values to GDALRaster without validation. A crafted value can enable arbitrary file writes, SSRF, and potentially RCE. Upgrade to 5.2.17 or 6.0.8. \n\nMore details:  buff.ly/XYmO5Uh", "creation_timestamp": "2026-08-20T21:08:03.800882Z"}, {"uuid": "29654121-4e95-4199-a4ed-6f92d29adea4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://t.me/CyberDispatch/2485", "content": "Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.", "creation_timestamp": "2026-08-29T20:00:06.400259Z"}, {"uuid": "a4336dbe-7862-475b-ae38-074ddd4e7e9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15307", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3muwjoukr5c2a", "content": "\u300cDjango\u300d\u306b4\u4ef6\u306e\u8106\u5f31\u6027 - \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\n\u30a6\u30a7\u30d6\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u300cDjango\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u305f\u3002\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308b\u3002\n\n\u958b\u767a\u30c1\u30fc\u30e0\u304c\u73fe\u5730\u6642\u95932026\u5e748\u67084\u65e5\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3057\u3001\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3068\u306a\u308b\u300cDjango 6.0.8\u300d\u300c\u540c5.2.17\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3053\u3068\u3092\u660e\u3089\u304b\u306b\u3057\u305f\u3002\u3042\u308f\u305b\u30664\u4ef6\u306e\u8106\u5f31\u6027\u3078\u5bfe\u51e6\u3057\u3066\u3044\u308b\u3002\n\n\u300cCVE-2026-15307\u300d\u306f\u3001\u4e00\u90e8\u30bf\u30a4\u30d7\u306e\u7a7a\u9593\u30eb\u30c3\u30af\u30a2\u30c3\u30d7\u306b\u3088\u3063\u3066\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u66f8\u304d\u8fbc\u307f\u3084\u5916\u90e8\u3078\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u53ef\u80fd\u3068\u306a\u308b\u8106\u5f31\u6027\u3002\u4e00\u90e8\u74b0\u5883\u3067\u306f\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u304a\u305d\u308c\u3082\u3042\u308b\u3068\u3044\u3046\u3002", "creation_timestamp": "2026-09-07T12:39:46.612888Z"}]}