9004 matches found
CVE-2026-61599: Use of Externally-Controlled Input to Select Classes or Code
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...
CVE-2026-61588: Exposure of Sensitive Information to an Unauthorized Actor
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...
CVE-2026-61597: Improper Neutralization of Input During Web Page Generation
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...
PT-2026-99259
TuxCare rebuilt django to address 4 CVEs. Fixed in 5.0.post13+tuxcare...
CVE-2026-61592: Session Fixation
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...
CVE-2026-61593: Cross-Site Request Forgery (CSRF)
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...
Fedora 44 : python-django6 (2026-6613125727)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6613125727 advisory. Update python-django6 providing python3-django to the latest 6.1.1 release Tenable has extracted the preceding description block directly from the...
CVE-2026-61596: Authorization Bypass Through User-Controlled Key
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...
CLSA-2026-1789475453 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post5+tuxcare...
CLSA-2026-1789475134 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.post9+tuxcare...
CLSA-2026-1789455474 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.post12+tuxcare...
CLSA-2026-1789454744 TuxCare security update for django (5 CVEs)
TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post9+tuxcare...
CLSA-2026-1789454358 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post7+tuxcare...
CLSA-2026-1789453540 TuxCare security update for django (2 CVEs)
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post6+tuxcare...
PT-2026-98443
TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post9+tuxcare...
PT-2026-98442
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post7+tuxcare...
PT-2026-98440
TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post6+tuxcare...
PT-2026-99038
TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post5+tuxcare...