Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

djust-org — Vulnerabilities & Security Advisories 14

Browse all 14 CVE security advisories affecting djust-org. AI-powered Chinese analysis, POCs, and references for each vulnerability.

This page aggregates vulnerability data specifically for the vendor djust-org, focusing on software weaknesses and associated security tags. The collection encompasses a wide spectrum of reported issues, ranging from buffer overflows and privilege escalation flaws to logic errors and cryptographic weaknesses, covering the period from the organization's earliest public disclosures to the most recent updates. Visitors can utilize this resource to track the vendor's security advisories over time, analyze the prevalence and characteristics of specific weakness classes within their ecosystem, or examine the complete vulnerability history of individual products developed by djust-org. The data presented here serves as a centralized reference for security professionals, researchers, and maintainers who need to assess risk trends without navigating disparate sources. By consolidating these findings, the page facilitates a clearer understanding of how the vendor addresses security concerns and evolves its defensive posture. Users may filter entries by severity, component, or affected version to perform targeted investigations into potential threats. This aggregation supports proactive defense strategies by highlighting recurring patterns and unpatched exposures that require immediate attention. All information is derived from publicly available reports and official vendor communications, ensuring accuracy and relevance for ongoing security assessments.

Top products by djust-org: djust
CVE ID Title CVSS Severity Published
CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool — djust CWE-22 3.3 Low 2026-10-20
CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path — djust CWE-470 8.8 High 2026-09-16
CVE-2026-61589 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path — djust CWE-348 6.3 Medium 2026-09-16
CVE-2026-61596 djust has broken object-level access control (IDOR) — djust CWE-639 7.1 High 2026-09-16
CVE-2026-61588 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client — djust CWE-200 6.5 Medium 2026-09-16
CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path — djust CWE-306 9.1 Critical 2026-09-16
CVE-2026-61591 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) — djust CWE-345 8.1 High 2026-09-16
CVE-2026-61592 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) — djust CWE-384 7.4 High 2026-09-16
CVE-2026-61597 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags — djust CWE-79 5.1 Medium 2026-09-16
CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session — djust CWE-352 8.1 High 2026-09-16
CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data — djust CWE-636 7.7 High 2026-09-16
CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler — djust CWE-915 7.1 High 2026-09-16
CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG — djust CWE-306 7.4 High 2026-09-16
CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls — djust CWE-285 8.2 High 2026-08-25

This page lists every published CVE security advisory associated with djust-org. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.