CVE-2026-70395

The CVE-2026-70395 description identifies a vulnerability in ash-project where, for belongs_to relationships using on_lookup: :relate, a client-provided lookup value is passed to Ash.Query.filter/2 without type casting. This can cause a nested map to be treated as a filter predicate rather than a...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659

CVE-2026-69659 affects ash-project Ash, specifically the keyset pagination cursor handling in Ash.Page.Keyset. Read actions using keyset pagination deserialize client-supplied page[:after] or page[:before] by base64 decoding the cursor and passing it to Erlang :erlang.binary_to_term/2 without siz...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

EUVD-2026-54937

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-19323

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323

CVE-2026-19323 affects the generateProjectDocs function in src/index.ts of the analyze-projec component of the azer react-analyzer-mcp. The vulnerability arises from manipulation of the projectName argument, which can lead to path traversal. Exploitation is described as requiring local access. Th...

EUVD-2026-54837

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323 azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-70395: Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

CVE-2026-69659: Deserialization of Untrusted Data

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

PT-2026-69309

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.52.0-rc.11 through 3.31.0 Description Improper Neutralization of Special Elements in Data Query Logic allows an attacker to forge a relationship to a record they cannot name and recover the secret value used for...

PT-2026-69308

Name of the Vulnerable Software and Affected Versions ash-project ash versions 1.17.0 through 3.31.0 Description An uncontrolled resource consumption issue exists where an attacker can exhaust node memory using a crafted keyset pagination cursor. Read actions utilizing keyset pagination deseriali...

MAL-2026-13672 Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4836c93e5c62158ffed799c206fa3713291692e10efae048c04fff0745f7070f Package [email protected] contains no code patterns matching known supply-chain attack fingerprints. N...

CVE-2026-19284

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...

EUVD-2026-54785

A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.createDomain/JsonMemoryStorage.getMemories/JsonMemoryStorage.saveMemories of the file src/tools/memoryTools.ts. The manipulation...

CVE-2026-19284 MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...