Lucene search
+L

382 matches found

CVE
CVE
added 2026/09/04 2:31 p.m.3 views

CVE-2026-82728

Mint (the Elixir HTTP client library, elixir-mint/mint) suffers from unbounded buffering in its HTTP/1 response parser. In lib/mint/http1.ex, decode_status_line/4 and decode_body/5 accumulate unconsumed server data in conn.buffer without any size cap, because the :max_header_list_size budget is o...

8.2CVSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/04 1:27 a.m.7 views

sobelow

Sobelow Sobelow es una herramienta de análisis estático enfocada en la seguridad para Elixir y el framework Phoenix. Para los investigadores de seguridad, es una herramienta útil para obtener una visión rápida de los puntos de interés. Para los mantenedores de proyectos, se puede usar para preven...

5.7AI score
SaveExploits0References1
NVD
NVD
added 2026/09/01 5:17 a.m.5 views

CVE-2026-82747

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

5.9CVSS0.0012EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/01 4:18 a.m.6 views

CVE-2026-82745

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

5.9CVSS0.00122EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/01 4:18 a.m.6 views

CVE-2026-82746

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

5.9CVSS0.0012EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/01 4:18 a.m.7 views

CVE-2026-82740

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...

2.1CVSS0.00126EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/01 4:18 a.m.6 views

CVE-2026-82738

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

5.9CVSS0.00138EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/01 4:18 a.m.8 views

CVE-2026-82736

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

2.1CVSS0.00138EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/01 4:14 a.m.4 views

CVE-2026-82747 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

5.9CVSS5.8AI score0.0012EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/09/01 4:14 a.m.36 views

CVE-2026-82747 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an accesstype :runtime read policy a check evaluated per record rather than compiled to a filter, Ash.Policy.Authorizer decides each record in checkresult/1...

5.9CVSS0.0012EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/01 3:47 a.m.37 views

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

5.9CVSS0.0012EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/01 3:47 a.m.3 views

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

5.9CVSS6AI score0.0012EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/09/01 3:42 a.m.37 views

CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

5.9CVSS0.00122EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/01 3:39 a.m.3 views

CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

2.1CVSS5.8AI score0.00133EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/09/01 3:39 a.m.7 views

EUVD-2026-68949

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

2.1CVSS5.8AI score0.00133EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/01 3:37 a.m.36 views

CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. Ash.Actions.Read.AsyncLimiter.awaitatleastone/1 lib/ash/actions/read/asynclimiter.ex waited for concurrent async read tasks by...

2.1CVSS0.00126EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/01 3:33 a.m.7 views

EUVD-2026-68946

Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...

2.1CVSS5.9AI score0.00133EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/01 3:21 a.m.3 views

CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

2.1CVSS5.9AI score0.00138EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/01 2:08 a.m.6 views

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

6.3CVSS5.9AI score0.00315EPSS
SaveExploits0References9
NVD
NVD
added 2026/08/31 1:16 a.m.10 views

CVE-2026-77956

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

8.9CVSS0.00195EPSS
SaveExploits0References4
Rows per page
Query Builder