djust-org vulnerabilities

Newest CVEs

• CVE-2026-113731

  djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

  djust-org · djust

  Low3.3
• CVE-2026-61599

  djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

  djust-org · djust

  High8.8
• CVE-2026-61589

  djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

  djust-org · djust

  Medium6.3
• CVE-2026-61596

  djust has broken object-level access control (IDOR)

  djust-org · djust

  High7.1
• CVE-2026-61588

  djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

  djust-org · djust

  Medium6.5
• CVE-2026-61594

  djust has an authorization bypass on the WebSocket/SSE mount path

  djust-org · djust

  Critical9.1
• CVE-2026-61591

  djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

  djust-org · djust

  High8.1
• CVE-2026-61592

  djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

  djust-org · djust

  High7.4
• CVE-2026-61597

  djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

  djust-org · djust

  Medium5.1
• CVE-2026-61593

  djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

  djust-org · djust

  High8.1