EUVD-2026-68287

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...

CVE-2026-80223

ash_graphql (Elixir GraphQL binding for the Ash framework) contains a cross-tenant subscription disclosure in its subscription resolver (AshGraphql.Graphql.Resolver). The fast path calls Ash.can/3 with run_queries?: false, evaluating the read policy filter in memory via Ash.Expr.eval/2 without is...

CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...

CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fast path...

EEF-CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

Summary Incorrect Authorization vulnerability in ash-project ashgraphql allows an authenticated subscriber in one tenant to receive another tenant's records over GraphQL subscriptions. The subscription resolver in AshGraphql.Graphql.Resolver authorizes each notification payload in memory: its fas...

CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

PT-2026-83630

Name of the Vulnerable Software and Affected Versions ash graphql versions 1.4.0 through 1.10.9 Description An incorrect authorization issue exists in the subscription resolver within AshGraphql.Graphql.Resolver. This allows an authenticated subscriber in one tenant to receive records belonging t...

CVE-2026-82454

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

EUVD-2026-68109

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

CVE-2026-82454

CVE-2026-82454 is a CRITICAL authentication bypass in the Omnivore API (packages/api), affecting versions before android-0.227.0 . The decodeAppleToken function extracted the alg field from an attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Because jsonwe...

CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

CVE-2026-82454 Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

CVE-2026-82454

The Omnivore API packages/api before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify. Using...

Improper Certificate Validation

org.mariadb.jdbc:mariadb-java-client is vulnerable to Improper Certificate Validation. The vulnerability is due to improper certificate fingerprint validation during the initial TLS handshake, which allows an active man-in-the-middle attacker or malicious server to present a self-signed certifica...

Malicious Package

Overview test-in-one is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview discord-mfa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

CVE-2026-41012 BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can...

CVE-2026-41012

CVE-2026-41012 is a traffic interception vulnerability in BOSH Director vSphere CPI (all versions prior to v98.0.6 ) caused by insufficient certificate validation and pinning in the communication between BOSH Director and vCenter. An attacker positioned between the two can impersonate the vCenter...

Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...