Login Request a demo
AS
Product
ash_admin
by ash-project · last CVE Aug 31, 2026
7
CVEs
0
On KEV
8.4
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 0High 4Medium 0Low 3
Severity
All severities7Critical0High4Medium0Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ash_admin to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-77850
8.4
0%
Aug 31
Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
Affected: 0.13.0 before 1.3.1; eb940f4d7d857ca49368ae847f586d01c6f5ad35 before 07289191ccdac27dd70ab7c6413ed057bc7fdade
CVE-2026-82673
8.3
1%
Aug 31
Path traversal in AshAdmin file uploads via unsanitized client filename
Affected: 0.13.7 before 1.3.1; e8f496b6a064ad67dc1cd30433e5921d2192d254 before 4bb41cb697f3d9be58462d727aed75aba76efc82
CVE-2026-82722
8.3
0%
Aug 31
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
Affected: 0.1.0 before 1.3.1; 98b03baa8422b94dd13e305bf08b8ee3f7232c7b before 731dffa09416d68f4ad3a0b6ee146b285ca0083b
CVE-2026-75757
8.3
1%
Aug 31
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
Affected: 0.9.1 before 1.3.1; 77a43cc4fa04cb59c38fc434568a35a38ecb995a before e93a3408a85035e1f90275d02bc2470c96095e56
Showing 4