D
Vendor security profile
djust-org
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs13
Critical1
CISA KEV0
Public exploit1
Patch rate%8
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
12
0
CVE KEV
CVE severity distribution
13toplam CVE
Critical1 (8%)
High9 (69%)
Medium3 (23%)
Patch and exploitation view
%8
Verified patch
%0
CISA KEV
%8
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
12Unknown
Latest vulnerabilities
8.8
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
D
Patch status unknownEPSS %1
6.3
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
D
Patch status unknownEPSS %0
7.1
CVE-2026-61596
djust has broken object-level access control (IDOR)
D
Patch status unknownEPSS %0
6.5
CVE-2026-61588
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
D
Patch status unknownEPSS %0
9.1
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
D
Patch status unknownEPSS %0
8.1
CVE-2026-61591
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
D
Patch status unknownEPSS %0
7.4
CVE-2026-61592
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
D
Patch status unknownEPSS %0
5.1
CVE-2026-61597
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
D
Patch status unknownEPSS %0
8.1
CVE-2026-61593
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
D
Patch status unknownEPSS %0
7.7
CVE-2026-61595
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
D
Patch status unknownEPSS %0