CVE-2026-6578

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-259CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-657807.0Double free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-657817.0Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-657827.0Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-657837.0Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.CVE-2026-657845.5Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.CVE-2026-657856.5Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.CVE-2026-657867.8Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-657877.8Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-657887.0Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-657898.1Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.CVE-2026-65796.5A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the cCVE-2026-657907.8Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
CVE-2026-6578: Medium severity, CVSS 5.6 | Vulnix