CVE-2026-82744

ash-project ash (Elixir library) contains a Failing Open vulnerability in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex). When a where guard controlling a change step raises an exception (e.g., on attacker-influenced input), the rescue in apply_validation converts it to {:error, er...

EEF-CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises

Summary Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

CVE-2026-84200: Improper Access Control

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

PT-2026-84093

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

PT-2026-84387

Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only the low-privileged feature access required to use the Observability AI Assistant can submit a specially crafted request that produces an unhandled error...

ROS-20260901-73-0046

The vulnerability in Netty is related to incorrect handling of exceptional states. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in security patch INA-release-9.6.26.08.SP03. Vulnerability Details CVEID:CVE-2026-27448 DESCRIPTION: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, i...

CVE-2026-82727

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

EUVD-2026-68334

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

CVE-2026-82580

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

CVE-2026-82580

CVE-2026-82580 affects ash_ai (versions 0.6.0 through

CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

EEF-CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result...

CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

EUVD-2026-68308

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

Important: dotnet9.0

Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...

Important: dotnet10.0

Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...

Important: dotnet8.0

Issue Overview: Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized...

Linux Distros Unpatched Vulnerability : CVE-2026-47893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception...