# Djust-Org Djust vulnerabilities

Source: https://junglewise.ai/threats/technologies/djust-org-djust  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/djust-org-djust.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 12 vulnerabilities in Djust-Org Djust: 0 in the last 7 days and 12 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-61599, was published on 16 September 2026. Nothing in the last four weeks, down from 11 vulnerabilities in the four before. 0 critical against 1.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 12
- All time: 12 (1 critical, 0 exploited in the wild)

## Latest Djust-Org Djust vulnerabilities

- [CVE-2026-61599: djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse) (high, CVSS 4, published 16 Sep 2026)
- [CVE-2026-61596: djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor) (high, CVSS 7.1, published 16 Sep 2026)
- [CVE-2026-61588: djust Django model serialization sensitive data exposure](https://junglewise.ai/threats/cve-2026-61588-djust-django-model-serialization-sensitive-data-exposure) (medium, CVSS 6.5, published 16 Sep 2026)
- [CVE-2026-61597: djust stored/reflected XSS via javascript: URLs in component tags](https://junglewise.ai/threats/cve-2026-61597-djust-stored-reflected-xss-via-javascript-urls-in-component-tags) (medium, CVSS 4, published 16 Sep 2026)
- [CVE-2026-61594: djust authorization bypass on WebSocket/SSE mount path](https://junglewise.ai/threats/cve-2026-61594-djust-authorization-bypass-on-websocket-sse-mount-path) (critical, CVSS 9.1, published 16 Sep 2026)
- [CVE-2026-61592: djust SSE session hijacking via client-chosen session_id](https://junglewise.ai/threats/cve-2026-61592-djust-sse-session-hijacking-via-client-chosen-session-id) (high, CVSS 7.4, published 16 Sep 2026)
- [CVE-2026-61591: djust state snapshot state injection vulnerability](https://junglewise.ai/threats/cve-2026-61591-djust-state-snapshot-state-injection-vulnerability) (high, CVSS 8.1, published 16 Sep 2026)
- [CVE-2026-61595: djust multi-tenant isolation bypass on WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61595-djust-multi-tenant-isolation-bypass-on-websocket-sse) (high, CVSS 7.7, published 16 Sep 2026)
- [CVE-2026-61593: djust Server-Sent-Events cross-site request forgery](https://junglewise.ai/threats/cve-2026-61593-djust-server-sent-events-cross-site-request-forgery) (high, CVSS 8.1, published 16 Sep 2026)
- [CVE-2026-61598: djust mass-assignment of arbitrary view attributes in update_model handler](https://junglewise.ai/threats/cve-2026-61598-djust-mass-assignment-of-arbitrary-view-attributes-in-update) (high, CVSS 4, published 16 Sep 2026)
- [CVE-2026-61590: djust observability endpoints authentication bypass](https://junglewise.ai/threats/cve-2026-61590-djust-observability-endpoints-authentication-bypass) (high, CVSS 7.4, published 16 Sep 2026)
- [CVE-2026-55571: djust authentication bypass in LiveView WebSocket mount](https://junglewise.ai/threats/cve-2026-55571-djust-authentication-bypass-in-liveview-websocket-mount) (high, CVSS 8.2, published 25 Aug 2026)

## Most severe Djust-Org Djust vulnerabilities

- [CVE-2026-61594: djust authorization bypass on WebSocket/SSE mount path](https://junglewise.ai/threats/cve-2026-61594-djust-authorization-bypass-on-websocket-sse-mount-path) (critical, CVSS 9.1, published 16 Sep 2026)
- [CVE-2026-55571: djust authentication bypass in LiveView WebSocket mount](https://junglewise.ai/threats/cve-2026-55571-djust-authentication-bypass-in-liveview-websocket-mount) (high, CVSS 8.2, published 25 Aug 2026)
- [CVE-2026-61591: djust state snapshot state injection vulnerability](https://junglewise.ai/threats/cve-2026-61591-djust-state-snapshot-state-injection-vulnerability) (high, CVSS 8.1, published 16 Sep 2026)
- [CVE-2026-61593: djust Server-Sent-Events cross-site request forgery](https://junglewise.ai/threats/cve-2026-61593-djust-server-sent-events-cross-site-request-forgery) (high, CVSS 8.1, published 16 Sep 2026)
- [CVE-2026-61595: djust multi-tenant isolation bypass on WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61595-djust-multi-tenant-isolation-bypass-on-websocket-sse) (high, CVSS 7.7, published 16 Sep 2026)
- [CVE-2026-61592: djust SSE session hijacking via client-chosen session_id](https://junglewise.ai/threats/cve-2026-61592-djust-sse-session-hijacking-via-client-chosen-session-id) (high, CVSS 7.4, published 16 Sep 2026)
- [CVE-2026-61590: djust observability endpoints authentication bypass](https://junglewise.ai/threats/cve-2026-61590-djust-observability-endpoints-authentication-bypass) (high, CVSS 7.4, published 16 Sep 2026)
- [CVE-2026-61596: djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor) (high, CVSS 7.1, published 16 Sep 2026)
- [CVE-2026-61599: djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse) (high, CVSS 4, published 16 Sep 2026)
- [CVE-2026-61598: djust mass-assignment of arbitrary view attributes in update_model handler](https://junglewise.ai/threats/cve-2026-61598-djust-mass-assignment-of-arbitrary-view-attributes-in-update) (high, CVSS 4, published 16 Sep 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 11 vulnerabilities in the four before. 0 critical against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 1 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 11 | 1 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Djust-Org Djust vulnerabilities", https://junglewise.ai/threats/technologies/djust-org-djust, 9 November 2026.