# djust (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/djust Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/djust.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in djust (PyPI): 0 in the last 7 days and 16 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113731, was published on 20 October 2026. 1 vulnerability in the last four weeks, down 93% on the four before (14). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 16 - All time: 16 (1 critical, 0 exploited in the wild) ## About djust (PyPI) Unknown package; insufficient information to describe confidently. ## Latest djust (PyPI) vulnerabilities - [CVE-2026-113731: djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0…](https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side) (low, CVSS 3.3, published 20 Oct 2026) - [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf) (high, CVSS 6.1, published 17 Sep 2026) - [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871) (info, published 17 Sep 2026) - [CVE-2026-61599: djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse) (high, CVSS 4, published 16 Sep 2026) - [CVE-2026-61596: djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor) (high, CVSS 7.1, published 16 Sep 2026) - [CVE-2026-61589: djust host header omission in WebSocket tenant resolution](https://junglewise.ai/threats/cve-2026-61589-djust-host-header-omission-in-websocket-tenant-resolution) (medium, CVSS 6.3, published 16 Sep 2026) - [CVE-2026-61588: djust Django model serialization sensitive data exposure](https://junglewise.ai/threats/cve-2026-61588-djust-django-model-serialization-sensitive-data-exposure) (medium, CVSS 6.5, published 16 Sep 2026) - [CVE-2026-61597: djust stored/reflected XSS via javascript: URLs in component tags](https://junglewise.ai/threats/cve-2026-61597-djust-stored-reflected-xss-via-javascript-urls-in-component-tags) (medium, CVSS 4, published 16 Sep 2026) - [CVE-2026-61594: djust authorization bypass on WebSocket/SSE mount path](https://junglewise.ai/threats/cve-2026-61594-djust-authorization-bypass-on-websocket-sse-mount-path) (critical, CVSS 9.1, published 16 Sep 2026) - [CVE-2026-61592: djust SSE session hijacking via client-chosen session_id](https://junglewise.ai/threats/cve-2026-61592-djust-sse-session-hijacking-via-client-chosen-session-id) (high, CVSS 7.4, published 16 Sep 2026) - [CVE-2026-61591: djust state snapshot state injection vulnerability](https://junglewise.ai/threats/cve-2026-61591-djust-state-snapshot-state-injection-vulnerability) (high, CVSS 8.1, published 16 Sep 2026) - [CVE-2026-61595: djust multi-tenant isolation bypass on WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61595-djust-multi-tenant-isolation-bypass-on-websocket-sse) (high, CVSS 7.7, published 16 Sep 2026) - [CVE-2026-61593: djust Server-Sent-Events cross-site request forgery](https://junglewise.ai/threats/cve-2026-61593-djust-server-sent-events-cross-site-request-forgery) (high, CVSS 8.1, published 16 Sep 2026) - [CVE-2026-61598: djust mass-assignment of arbitrary view attributes in update_model handler](https://junglewise.ai/threats/cve-2026-61598-djust-mass-assignment-of-arbitrary-view-attributes-in-update) (high, CVSS 4, published 16 Sep 2026) - [CVE-2026-61590: djust observability endpoints authentication bypass](https://junglewise.ai/threats/cve-2026-61590-djust-observability-endpoints-authentication-bypass) (high, CVSS 7.4, published 16 Sep 2026) - [CVE-2026-55571: djust authentication bypass in LiveView WebSocket mount](https://junglewise.ai/threats/cve-2026-55571-djust-authentication-bypass-in-liveview-websocket-mount) (high, CVSS 8.2, published 25 Aug 2026) ## Most severe djust (PyPI) vulnerabilities - [CVE-2026-61594: djust authorization bypass on WebSocket/SSE mount path](https://junglewise.ai/threats/cve-2026-61594-djust-authorization-bypass-on-websocket-sse-mount-path) (critical, CVSS 9.1, published 16 Sep 2026) - [CVE-2026-55571: djust authentication bypass in LiveView WebSocket mount](https://junglewise.ai/threats/cve-2026-55571-djust-authentication-bypass-in-liveview-websocket-mount) (high, CVSS 8.2, published 25 Aug 2026) - [CVE-2026-61591: djust state snapshot state injection vulnerability](https://junglewise.ai/threats/cve-2026-61591-djust-state-snapshot-state-injection-vulnerability) (high, CVSS 8.1, published 16 Sep 2026) - [CVE-2026-61593: djust Server-Sent-Events cross-site request forgery](https://junglewise.ai/threats/cve-2026-61593-djust-server-sent-events-cross-site-request-forgery) (high, CVSS 8.1, published 16 Sep 2026) - [CVE-2026-61595: djust multi-tenant isolation bypass on WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61595-djust-multi-tenant-isolation-bypass-on-websocket-sse) (high, CVSS 7.7, published 16 Sep 2026) - [CVE-2026-61592: djust SSE session hijacking via client-chosen session_id](https://junglewise.ai/threats/cve-2026-61592-djust-sse-session-hijacking-via-client-chosen-session-id) (high, CVSS 7.4, published 16 Sep 2026) - [CVE-2026-61590: djust observability endpoints authentication bypass](https://junglewise.ai/threats/cve-2026-61590-djust-observability-endpoints-authentication-bypass) (high, CVSS 7.4, published 16 Sep 2026) - [CVE-2026-61596: djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor) (high, CVSS 7.1, published 16 Sep 2026) - [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf) (high, CVSS 6.1, published 17 Sep 2026) - [CVE-2026-61599: djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse) (high, CVSS 4, published 16 Sep 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 93% on the four before (14). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 14 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "djust (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/djust, 13 November 2026.