Login Request a demo
AS
Product
ash_admin
by ash-project · last CVE Aug 31, 2026
7
CVEs
0
On KEV
8.4
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 0High 4Medium 0Low 3
Severity
All severities7Critical0High4Medium0Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ash_admin to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-81853
2.3
0%
Aug 31
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Affected: 0.1.0 before 1.3.1; 98b03baa8422b94dd13e305bf08b8ee3f7232c7b before 3c3e905d47f1155dcc1ca3fb347348b05a66065a
CVE-2026-81852
2.1
1%
Aug 31
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
Affected: 0.10.8 before 1.3.1; 99b8daed7b2f79d82fcd9e89338d41b0e1564aa7 before bc7a1cdf873b16971a8efec35d085f8bb706314f
CVE-2026-82681
2.0
0%
Aug 31
Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
Affected: 0.3.0-rc.0 before 1.3.1; b214535f0cc012e36ca621e643bf8f7b133ba354 before 8e8ef91e8ba07498053887c6212f8b0f08178df6
Showing 3