What’s Vulnerable › Products

djust-org djust vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Check whether your djust-org djust version is affected

Latest djust-org djust vulnerabilities

• CVE-2026-113731 — djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool (CVSS 3.3)
• CVE-2026-61599 — djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path (CVSS 8.8)
• CVE-2026-61596 — djust has broken object-level access control (IDOR) (CVSS 7.1)
• CVE-2026-61589 — djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path (CVSS 6.3)
• CVE-2026-61588 — djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client (CVSS 6.5)
• CVE-2026-61597 — djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags (CVSS 5.1)
• CVE-2026-61594 — djust has an authorization bypass on the WebSocket/SSE mount path (CVSS 9.1)
• CVE-2026-61592 — djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) (CVSS 7.4)
• CVE-2026-61591 — djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) (CVSS 8.1)
• CVE-2026-61595 — djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data (CVSS 7.7)
• CVE-2026-61593 — djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session (CVSS 8.1)
• CVE-2026-61598 — Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler (CVSS 7.1)
• CVE-2026-61590 — djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG (CVSS 7.4)
• CVE-2026-55571 — djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls (CVSS 8.2)