Ddjust-org

Products

Exploited and recent CVEs

• CVE-2026-113731 Low 3.3 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool 0.2%
• CVE-2026-61599 High 8.8 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path 0.6%
• CVE-2026-61589 Medium 6.3 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path 0.2%
• CVE-2026-61596 High 7.1 djust has broken object-level access control (IDOR) 0.3%
• CVE-2026-61588 Medium 6.5 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client 0.4%
• CVE-2026-61594 Critical 9.1 djust has an authorization bypass on the WebSocket/SSE mount path 0.5%
• CVE-2026-61591 High 8.1 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) 0.2%
• CVE-2026-61592 High 7.4 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) 0.4%
• CVE-2026-61597 Medium 5.1 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags 0.4%
• CVE-2026-61593 High 8.1 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session 0.2%
• CVE-2026-61595 High 7.7 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data 0.4%
• CVE-2026-61598 High 7.1 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler 0.4%
• CVE-2026-61590 High 7.4 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG 0.4%
• CVE-2026-55571 High 8.2 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls 0.5%