EUVD-2026-69246

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large. snmppdus:decintegernotag/1 defaults its size limit to infinity, and...

CVE-2026-42008

A flaw was found in Dovecot. Forwarded information from a host listed as a trusted proxy is not properly separated from Dovecot's internal authentication fields. This allows a malicious host configured as a trusted proxy to inject values as internal authentication fields, enabling it to...

CVE-2026-82739 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check. Ash.Resource.Validation.Confirm's atomic implementation atomic/2 in lib/ash/resource/validation/confirm.ex...

CVE-2026-82730

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-77856

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-74837

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

EUVD-2026-68929

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. AshTypescript.FieldFormatter.converttofieldatom/2 in...

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

EUVD-2026-68926

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-82730

ash_typescript (v0.11.0

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

EEF-CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Summary Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because...

EEF-CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...