CVE-2026-61588 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...

GHSA-PVG3-6Q9J-MJ3X djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. isstaff / issuperuser, tokens, and other PII to the browser. Because exposing model objec...

Malicious code in tikapermata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e21a593da097d40071ca74a87f8c96dd8abf07d55a78c2a49c1687ed59c448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-ragi4-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2d0f2c29966bf14b1e217f7bcccf2d878cfed238d6c2d39c8f916e08db0059f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

UBUNTU-CVE-2017-18222

In the Linux kernel before 4.12, Hisilicon Network Subsystem HNS does not consider the ETHSSPRIVFLAGS case when retrieving ssetcount data, which allows local users to cause a denial of service buffer overflow and memory corruption or possibly have unspecified other impact, as demonstrated by...