CVE-2026-92399

GPAC 26.07.0 contains a heap-based buffer overflow in the function rmt_client_handle_ws_frame within the WebSocket Handler component (src/utils/rmt_ws.c). The vulnerability is triggered by manipulating the payload_size argument, allowing a remote attacker to exploit it without authentication or u...

EUVD-2026-80851

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61595

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, "djust.tenants" isolation was enforced only on the HTTP path. The current tenant was stored in "threading.local" and set exclusively by the HTTP-only...

CVE-2026-61595

djust prior to 1.0.7 provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Multi-tenant isolation was enforced only on the HTTP path: the current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware. On the...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

CVE-2026-61595 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

Missing Authorization

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Missing Authorization in the WebSocket/SSE path due to improper...

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...

GHSA-3492-CVG7-9MR2 djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path getcurrenttenant was always None during mount and every event handler — and the tenant-aware...

tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints

A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potential...

tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close

A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service DoS by making the server unresponsive...

tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts

A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable...

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

tomcat: Apache Tomcat: Authentication Bypass in WebSocket Endpoints

A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potential...

tomcat: Apache Tomcat: Denial of Service via busy wait during WebSocket close

A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service DoS by making the server unresponsive...

tomcat: Apache Tomcat: Denial of Service due to lost asynchronous WebSocket write timeouts

A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable...

tomcat: Apache Tomcat: WebSocket message smuggling via improper length handling

A flaw was found in Apache Tomcat. This vulnerability, related to improper handling of length parameters, allows for WebSocket message smuggling when the 'per-message-deflate' extension is in use. A remote attacker could exploit this to bypass security controls or inject malicious data into...

CVE-2026-61598 Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-61598

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, "djust.mixins.modelbinding.ModelBindingMixin" provides a default "updatemodel" event handler and is part of the LiveView base MRO, so every LiveView exposes it. I...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object...