Egor Saltykov

**Name of the Vulnerable Software and Affected Versions** Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7 **Description** An issue exists where `django.contrib.admin.utils.display for field()` renders `URLField` values as clickable links in the admin interface without proper validation. This allows stored cross-site scripting (XSS) against staff users who click the link if a value with an unsafe scheme is stored in the database. This occurs in applications that persist `URLField` data without running model validation, such as through direct queryset writes, deserialization, or bulk import of untrusted input. **Recommendations** Update Django versions 5.2 through 5.2.16 to version 5.2.17. Update Django versions 6.0 through 6.0.7 to version 6.0.8.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 10.3.3 Apple Safari versions prior to 10.1.2 Apple tvOS versions prior to 10.2.2 **Description** A DOMParser XSS issue was discovered in certain Apple products, involving the WebKit component. **Recommendations** For iOS versions prior to 10.3.3, update to version 10.3.3 or later. For Safari versions prior to 10.1.2, update to version 10.1.2 or later. For tvOS versions prior to 10.2.2, update to version 10.2.2 or later.