CVE-2026-6580

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the component Amap API Call Handler. Such manipulation of the argument key leads to use of hard-coded cryptographic key . The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-320CWE-321

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-6580110.0Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.CVE-2026-658027.4External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.CVE-2026-658046.1Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spooCVE-2026-658066.5Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.CVE-2026-658078.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code overCVE-2026-65818.8A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPInfoById of the file /CVE-2026-658107.8Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-658118.8Improper input validation in Power BI allows an authorized attacker to execute code over a network.CVE-2026-658126.8Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over CVE-2026-658138.8Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-658147.8Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.CVE-2026-658158.8Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-6580: High severity, CVSS 7.3 | Vulnix