Login Request a demo
AS
Product
ash_phoenix
by ash-project · last CVE Aug 31, 2026
4
CVEs
0
On KEV
7.6
Max CVSS
0
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 1Medium 1Low 2
Severity
All severities4Critical0High1Medium1Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ash_phoenix to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-82724
7.6
0%
Aug 31
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
Affected: 2.1.26 before 2.3.25; 9a5ea4d377bc263de321d79574872a3dfc4fb541 before b396e1aa5c6bdec39255f19cf938b539e6d28b71
CVE-2026-82726
6.3
1%
Aug 31
AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
Affected: 2.1.26 before 2.3.25; 9a5ea4d377bc263de321d79574872a3dfc4fb541 before 8306f29e77526840c89f3cd244996ce7c0fa2cda
CVE-2026-82725
2.3
0%
Aug 31
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
Affected: 0.6.0-rc.1 before 2.3.25; 06875682999938f607c970e71b6a80af90e18b3d before a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b
CVE-2026-82727
2.3
0%
Aug 31
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
Affected: 1.2.17 before 2.3.25; a3436fcc321e3b34c242cceaf62c3c92bc1a452b before 0c1775c3cf8988f9abd10a8f92315afc5f06f16d
Showing 4