PT-2026-105802

Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. is staff / is superuser, tokens, and other PII to the browser. Because exposing model...

EUVD-2026-81304

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in...

blendedux (>=0.1.0, <=0.1.4), blendedux-lang (>=1.1.0, <=1.1.2) +16 more potentially affected by CVE-2026-48587 via django (4.1.7)

django PYPI version 4.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - blendedux =0.1.0, =1.1.0, =0.0.1, =0.1.0, =0.5.0, =3.11.10, =1.0.0, =12.0.0, =1.3.2, =1.0.4, =1.0.11 and more Source cves: CVE-2026-48587 Source...

EUVD-2019-0039

Malware in sbrugna...

FreeBSD : Django -- multiple vulnerabilities (4e3fa78b-1577-11ea-b66e-080027bdabe8)

Django release reports : CVE-2019-19118: Privilege escalation in the Django admin. Since Django 2.1, a Django model admin displaying a parent model with related model inlines, where the user has view-only permissions to a parent model but edit permissions to the inline model, would display a...