CVE-2026-82733

ash_typescript (ash-project) is vulnerable to Generation of Error Message Containing Sensitive Information in its typed-controller. When a route handler returns anything other than a %Plug.Conn{}, the dispatch/3 function in request_handler.ex passes the value to unexpected_return/2, which interpo...

EUVD-2026-68928

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

EEF-CVE-2026-82733 Route handler return value echoed into AshTypescript error response

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn,...

EEF-CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

EUVD-2026-68925

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950

ash_typescript (versions 0.8.0 through before 0.18.0) contains a fail-open flaw in its RPC error handling. The apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex is the sole hook for redacting or suppressing errors before they reach the client. Because error handlers are conventio...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

ASB-A-470260357

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-511555858

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

ASB-A-493714520

In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-484011314

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

xmlrpc-c security update

1.51.0-17 - Fix HTML injection in Abyss error responses and directory listings - Resolves: CVE-2026-15928...

PUB-A-511553754

In enablesegment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508733257

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-510947703

In gsaswpkhashcompare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...