CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

CVE-2026-67579

The CVE affects ash-project ash (Ash) and describes a Deserialization of Untrusted Data vulnerability: an unauthenticated attacker can inject a filter expression through a forged keyset pagination cursor. The reader decodes page[:after]/page[:before] with non_executable_binary_to_term/2, allowing...

EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Summary Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination deco...

CVE-2026-15216 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

EUVD-2026-57437

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

CVE-2026-15216

GitLab CVE-2026-15216 affects GitLab CE/EE prior to patched versions: 19.0.6 (for 18.2 line), 19.1.4 (for 19.1 line), and 19.2.2 (for 19.2 line). The issue arises from improper neutralization of user-controlled data rendered in pagination controls within an analytics dashboard component, enabling...

CVE-2026-15216 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

GitLab 18.2 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15216)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site...

PT-2026-71309

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

EEF-CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659

CVE-2026-69659 affects ash-project Ash, specifically the keyset pagination cursor handling in Ash.Page.Keyset. Read actions using keyset pagination deserialize client-supplied page[:after] or page[:before] by base64 decoding the cursor and passing it to Erlang :erlang.binary_to_term/2 without siz...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

Malicious code in beaver-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb On require'beaver-ui-pagination', index.js loads init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts...

MAL-2026-12820 Malicious code in beaver-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb On require'beaver-ui-pagination', index.js loads init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts...

CVE-2026-15739

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-15739

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-48527

The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...