D
Üretici güvenlik profili
djust-org
Ürün portföyü, yama kanıtları ve sömürü sinyalleri tek güvenlik karnesinde
Veriler CVE Programı, NVD, CISA KEV ve üretici güvenlik bültenlerinden birleştirilir.
Toplam CVE13
Kritik1
CISA KEV0
Public exploit1
Yama oranı%8
Ort. CVSS7.5
12 aylık açık hızı
0
0
0
0
0
0
0
0
0
1
12
0
CVE KEV
CVE önem dağılımı
13toplam CVE
Kritik1 (8%)
Yüksek9 (69%)
Orta3 (23%)
Yama ve sömürü görünümü
%8
Doğrulanmış yama
%0
CISA KEV
%8
Public exploit
1Yama var
0Kısmi
0Geçici çözüm
0Üretici: yama yok
12Bilinmiyor
Son güvenlik açıkları
8.8
CVE-2026-61599
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
D
Yama durumu bilinmiyorEPSS %1
6.3
CVE-2026-61589
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
D
Yama durumu bilinmiyorEPSS %0
7.1
CVE-2026-61596
djust has broken object-level access control (IDOR)
D
Yama durumu bilinmiyorEPSS %0
6.5
CVE-2026-61588
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
D
Yama durumu bilinmiyorEPSS %0
9.1
CVE-2026-61594
djust has an authorization bypass on the WebSocket/SSE mount path
D
Yama durumu bilinmiyorEPSS %0
8.1
CVE-2026-61591
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)
D
Yama durumu bilinmiyorEPSS %0
7.4
CVE-2026-61592
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
D
Yama durumu bilinmiyorEPSS %0
5.1
CVE-2026-61597
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
D
Yama durumu bilinmiyorEPSS %0
8.1
CVE-2026-61593
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
D
Yama durumu bilinmiyorEPSS %0
7.7
CVE-2026-61595
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data
D
Yama durumu bilinmiyorEPSS %0