PT-2026-94190

Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description The Acer System Monitoring component, used in NitroSense and PredatorSense, contains a flaw where a WebSocket service is configured to listen ...

libsoup3 security update

3.6.5-14 - Fix CVE-2026-85197: http2 crash after connection destroyed 3.6.5-13 - Fix CVE-2026-15711: Reject oversized WebSocket control frames 3.6.5-12 - Fix CVE-2026-15709: bound decompressed WebSocket message size 3.6.5-11 - Add patches for CVE-2026-4271 and CVE-2026-5119 3.6.5-10 - Add patch f...

CVE-2026-54551: Improper Authorization

WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpointwebsocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdate...

Oracle Linux 9 : libsoup (ELSA-2026-68234)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68234 advisory. - Fix CVE-2026-15711: Reject oversized WebSocket control frames Tenable has extracted the preceding description block directly from the Oracle Linux...

RHEL 9 : libsoup (RHSA-2026:68612)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68612 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

RockyLinux 9 : libsoup (RLSA-2026:68234)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68234 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup:...

CVE-2026-61594

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61599

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling "importmodulepath, ...". The module is imported — running it...

GHSA-7PRP-2623-8G45 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

CVE-2026-61589

djust , a Phoenix LiveView-style reactive server-side rendering library for Django, had a tenant resolution flaw in versions prior to 1.0.7 . The WebSocket handle_mount and ViewRuntime._build_request rebuilt the HttpRequest via RequestFactory().get(...) without an HTTP_HOST header, causing reques...

CVE-2026-61589 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

Impact The WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP...

CVE-2026-61596

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization "getobject" + "hasobjectpermission", ADR-017 was enforced on the WebSocket mount and event paths but not on three other render...

djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

CVE-2026-61594

djust is a Phoenix LiveView-style reactive server-side rendering library for Django with Rust-powered performance. Prior to version 1.0.7 , its live WebSocket transport authorized view mounts via check_view_auth rather than Django's View.dispatch() chain. This caused standard Django authorization...

CVE-2026-61594 djust has an authorization bypass on the WebSocket/SSE mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live WebSocket transport authorizes a mount via checkviewauth, not Django's View.dispatch chain. As a result, standard Django authorization —...