DJ
Vendor
djust-org
14
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113731 | DJ djust djust-org | 3.3 | Oct 20 | djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool |
| CVE-2026-61599 | DJ djust djust-org | 8.8 | Sep 16 | djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path |
| CVE-2026-61589 | DJ djust djust-org | 6.3 | Sep 16 | djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path |
| CVE-2026-61596 | DJ djust djust-org | 7.1 | Sep 16 | djust has broken object-level access control (IDOR) |
| CVE-2026-61588 | DJ djust djust-org | 6.5 | Sep 16 | djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client |
| CVE-2026-61594 | DJ djust djust-org | 9.1 | Sep 16 | djust has an authorization bypass on the WebSocket/SSE mount path |
| CVE-2026-61591 | DJ djust djust-org | 8.1 | Sep 16 | djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) |
| CVE-2026-61592 | DJ djust djust-org | 7.4 | Sep 16 | djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) |
| CVE-2026-61597 | DJ djust djust-org | 5.1 | Sep 16 | djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags |
| CVE-2026-61593 | DJ djust djust-org | 8.1 | Sep 16 | djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session |
| CVE-2026-61595 | DJ djust djust-org | 7.7 | Sep 16 | djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data |
| CVE-2026-61598 | DJ djust djust-org | 7.1 | Sep 16 | Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler |
| CVE-2026-61590 | DJ djust djust-org | 7.4 | Sep 16 | djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG |
| CVE-2026-55571 | DJ djust djust-org | 8.2 | Aug 25 | djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls |