PT-2026-86368

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post14+tuxcare...

PT-2026-86369

TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.1.post5+tuxcare...

CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

Missing Authentication for Critical Function

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the handleevent...

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a ""type":"navigate","to":..." frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

EUVD-2026-65600

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

PT-2026-81390

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.4 Description An authentication bypass exists in the LiveViewConsumer when a view is restricted by login required, permission required, or a redirecting on mount hook. In these cases, the handle mount function sends...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

EUVD-2026-63564

django CMS: Page cache ignores plugin-declared Vary headers disclosure & poisoning...

GHSA-FWJF-M4QW-9F2X django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Summary The CMS page cache key ignores the request headers that plugins declare via getvarycacheon. The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless o...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the getvarycacheon process. An attacker can cause sensitive information to be disclosed to other users and manipulate cached content by priming the cache with attacker-controlled header...

GHSA-8JJ7-4V57-FRF5 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

EUVD-2026-63565

django CMS: Plugin move endpoint allows cyclic reparenting DoS...

django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

Summary The moveplugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker. Details...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the moveplugin process. An attacker can cause application workers to hang and corrupt the plugin tree by reparenting a plugin under itself or one of its descendants, resulting in infinite recursion during tree traversa...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...