The Django team is releasing Django 6.0.7 and Django 5.2.16 to address security vulnerabilities. One issue, CVE-2026-48588, could potentially expose private data through cached Set-Cookie responses. This occurred when caching responses that set cookies while varying on the Cookie header, but only if the incoming request had no cookies. Another vulnerability, CVE-2026-53877, involved a heap buffer over-read in GDALRaster when processing certain byte objects representing raster files. This could lead to information disclosure or segmentation faults, affecting rasters in GDAL's virtual filesystem. The third vulnerability, CVE-2026-53878, allowed header injection because DomainNameValidator accepted newline characters in domain names. While Django itself was not directly vulnerable, custom uses of DomainNameValidator outside of Django form fields were susceptible. These low-severity issues have been patched in the main, 6.1 beta, 6.0, and 5.2 branches of Django. Users are strongly encouraged to upgrade to the latest versions as soon as possible for security. Potential security issues should be reported privately to [email protected].