Login Request a demo
AS
Product
ash_postgres
by ash-project · last CVE Oct 25, 2026
4
CVEs
0
On KEV
7.2
Max CVSS
2
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 1Medium 3Low 0
Severity
All severities4Critical0High1Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ash_postgres to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-115627
New
6.0
0%
Oct 25
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Affected: 0.38.0 before 2.15.2; 7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 before 8c25c945c39a45299193fe70b09fc2fa2aacac7b
CVE-2026-115635
New
6.0
0%
Oct 25
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Affected: 2.6.22 before 2.15.2; af0903f1380468bbe1b61fe65acb33772b5e24a5 before 8aa81220c401cae412d21078d11b3519ea25d3a9
CVE-2024-49756
5.3
1%
Oct 23
AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.
Affected: >= 2.0.0, < 2.4.10
Showing 3