CVE Notifier

CVE-2026-65388 CWE-? N/A

CVE-2026-65388

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is ad…

cve.org Apple:containerization 16 Sep 2026

CVE-2026-61599 CWE-470 N/A

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61589 CWE-348 6.3

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61596 CWE-639 7.1

djust has broken object-level access control (IDOR)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) wa…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61588 CWE-200 6.5

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serializ…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61594 CWE-306 9.1

djust has an authorization bypass on the WebSocket/SSE mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61591 CWE-345 8.1

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the cl…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61592 CWE-384 7.4

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-61597 CWE-79 N/A

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) rende…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-92599 CWE-1333 7.5

Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the …

cve.org hapijs:joi · hapijs:joi 16 Sep 2026

CVE-2026-92598 CWE-436 6.5

Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can cr…

cve.org nodemailer:nodemailer 16 Sep 2026

CVE-2026-92597 CWE-436 6.5

Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surr…

cve.org nodemailer:nodemailer 16 Sep 2026