CVE-2026-61588 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...

GHSA-PVG3-6Q9J-MJ3X djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

Impact When a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as password the hash, privilege flags e.g. isstaff / issuperuser, tokens, and other PII to the browser. Because exposing model objec...

Exposure of Private Personal Information to an Unauthorized Actor

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in...

PT-2026-94117

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description When a Django Model instance is assigned to a public view attribute, the software serializes it to the client without a sensitive-field denylist. This results in the exposure of sensitive data to the...

Malicious code in tikapermata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e21a593da097d40071ca74a87f8c96dd8abf07d55a78c2a49c1687ed59c448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-ragi4-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2d0f2c29966bf14b1e217f7bcccf2d878cfed238d6c2d39c8f916e08db0059f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

UBUNTU-CVE-2017-18222

In the Linux kernel before 4.12, Hisilicon Network Subsystem HNS does not consider the ETHSSPRIVFLAGS case when retrieving ssetcount data, which allows local users to cause a denial of service buffer overflow and memory corruption or possibly have unspecified other impact, as demonstrated by...