Login Request a demo
AS
Vendor
ash-project
17 products with CVEs on record
90
CVEs
0
On KEV
7
New 30D
Products
AS
ash
ash-project
8.6
31 CVEs0 on KEV4 new
AS
ash_postgres
ash-project
7.2
3 CVEs0 on KEV2 new
AS
ash_typescript
ash-project
8.7
8 CVEs0 on KEV1 new
AS
ash_admin
ash-project
8.4
7 CVEs0 on KEV0 new
AS
ash_ai
ash-project
8.9
7 CVEs0 on KEV0 new
AS
ash_authentication_oauth2_server
ash-project
8.2
6 CVEs0 on KEV0 new
AS
ash_graphql
ash-project
8.7
6 CVEs0 on KEV0 new
AS
ash_sql
ash-project
5.9
5 CVEs0 on KEV0 new
AS
ash_phoenix
ash-project
7.6
4 CVEs0 on KEV0 new
AS
ash_paper_trail
ash-project
5.9
3 CVEs0 on KEV0 new
AS
ash_cloak
ash-project
5.9
2 CVEs0 on KEV0 new
AS
ash_lua
ash-project
8.2
2 CVEs0 on KEV0 new
AS
ash_oban
ash-project
5.9
2 CVEs0 on KEV0 new
AS
ash_double_entry
ash-project
2.1
1 CVEs0 on KEV0 new
AS
ash_sqlite
ash-project
2.1
1 CVEs0 on KEV0 new
IG
igniter
ash-project
2.3
1 CVEs0 on KEV0 new
US
usage_rules
ash-project
2.3
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-96581
New
AS
ash
ash-project
7.6
0%
Oct 26An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
CVE-2026-115627
New
AS
ash_postgres
ash-project
6.0
0%
Oct 25AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
CVE-2026-115635
New
AS
ash_postgres
ash-project
6.0
0%
Oct 25AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
CVE-2026-114214
New
AS
ash
ash-project
6.0
0%
Oct 25Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
CVE-2026-105283
AS
ash_typescript
ash-project
6.3
0%
Oct 12Internal error terms inspected into AshTypescript RPC error responses
CVE-2026-101028
AS
ash
ash-project
6.0
0%
Oct 9Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
CVE-2026-94201
AS
ash
ash-project
8.2
0%
Oct 5Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
CVE-2026-93477
AS
ash
ash-project
5.9
0%
Sep 25Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
CVE-2026-86338
AS
ash
ash-project
6.0
0%
Sep 16Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
CVE-2026-78216
AS
ash_lua
ash-project
6.0
0%
Sep 8AshLua eval read operations can read field-policy-protected fields via aggregates
CVE-2026-78230
AS
ash_ai
ash-project
6.0
0%
Sep 8AshAi aggregate tool can read field-policy-protected fields
CVE-2026-82710
US
usage_rules
ash-project
2.3
1%
Sep 8Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
CVE-2026-82584
IG
igniter
ash-project
2.3
1%
Sep 7Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
CVE-2026-82586
AS
ash_lua
ash-project
8.2
1%
Sep 7AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
CVE-2026-81638
AS
ash_double_entry
ash-project
2.1
0%
Sep 7Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
CVE-2026-82758
AS
ash_authentication_oauth2_server
ash-project
6.3
1%
Sep 7ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
CVE-2026-82757
AS
ash_authentication_oauth2_server
ash-project
6.3
1%
Sep 7ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
CVE-2026-82756
AS
ash_authentication_oauth2_server
ash-project
6.3
1%
Sep 7ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
CVE-2026-82755
AS
ash_authentication_oauth2_server
ash-project
6.3
1%
Sep 7ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
CVE-2026-82754
AS
ash_authentication_oauth2_server
ash-project
6.3
1%
Sep 7ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
CVE-2026-82753
AS
ash_authentication_oauth2_server
ash-project
8.2
1%
Sep 7Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
CVE-2026-82752
AS
ash
ash-project
5.9
0%
Sep 5Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
CVE-2026-82747
AS
ash
ash-project
5.9
0%
Sep 1Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82749
AS
ash
ash-project
5.9
0%
Sep 1Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
CVE-2026-82748
AS
ash
ash-project
2.1
0%
Sep 1Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
CVE-2026-82746
AS
ash
ash-project
5.9
0%
Sep 1Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
CVE-2026-82745
AS
ash
ash-project
5.9
0%
Sep 1ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
CVE-2026-82744
AS
ash
ash-project
2.1
0%
Sep 1Ash.Reactor change step fails open, skipping a change when its where guard raises
CVE-2026-82743
AS
ash
ash-project
2.1
0%
Sep 1Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82742
AS
ash
ash-project
5.9
0%
Sep 1Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
CVE-2026-82741
AS
ash
ash-project
2.1
0%
Sep 1Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82740
AS
ash
ash-project
2.1
0%
Sep 1Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82739
AS
ash
ash-project
2.1
0%
Sep 1Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
CVE-2026-82738
AS
ash
ash-project
5.9
0%
Sep 1Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
CVE-2026-82737
AS
ash
ash-project
5.9
0%
Sep 1Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
CVE-2026-82736
AS
ash
ash-project
2.1
0%
Sep 1Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
CVE-2026-82735
AS
ash
ash-project
5.9
0%
Sep 1Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82734
AS
ash
ash-project
2.1
0%
Sep 1Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
CVE-2026-82731
AS
ash_typescript
ash-project
2.3
0%
Sep 1Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
CVE-2026-74837
AS
ash_typescript
ash-project
8.7
1%
Sep 1Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
CVE-2026-82733
AS
ash_typescript
ash-project
6.3
1%
Sep 1Route handler return value echoed into AshTypescript error response
CVE-2026-82732
AS
ash_typescript
ash-project
6.3
1%
Sep 1Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82730
AS
ash_typescript
ash-project
8.2
0%
Sep 1Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-77950
AS
ash_typescript
ash-project
6.3
1%
Sep 1RPC error handler fails open in AshTypescript, disclosing unredacted errors
CVE-2026-77856
AS
ash_typescript
ash-project
8.2
1%
Sep 1Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-82725
AS
ash_phoenix
ash-project
2.3
0%
Aug 31AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
CVE-2026-82724
AS
ash_phoenix
ash-project
7.6
0%
Aug 31Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
CVE-2026-82726
AS
ash_phoenix
ash-project
6.3
1%
Aug 31AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
CVE-2026-82727
AS
ash_phoenix
ash-project
2.3
0%
Aug 31AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
CVE-2026-82673
AS
ash_admin
ash-project
8.3
1%
Aug 31Path traversal in AshAdmin file uploads via unsanitized client filename
CVE-2026-81853
AS
ash_admin
ash-project
2.3
0%
Aug 31AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
CVE-2026-81852
AS
ash_admin
ash-project
2.1
1%
Aug 31AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
CVE-2026-82681
AS
ash_admin
ash-project
2.0
0%
Aug 31Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
CVE-2026-77850
AS
ash_admin
ash-project
8.4
0%
Aug 31Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
CVE-2026-82722
AS
ash_admin
ash-project
8.3
0%
Aug 31AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
CVE-2026-75757
AS
ash_admin
ash-project
8.3
1%
Aug 31AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
CVE-2026-75760
AS
ash_ai
ash-project
7.1
0%
Aug 31AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
CVE-2026-82580
AS
ash_ai
ash-project
5.3
0%
Aug 31AshAi echoes raw tool exception messages into the conversation, disclosing internal details
CVE-2026-82579
AS
ash_ai
ash-project
6.0
0%
Aug 31AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
CVE-2026-82564
AS
ash_ai
ash-project
7.1
1%
Aug 31Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records