store-api

RESTful API auto-generation for common-store data layer fastify + fastapi adapters over GQL, spec-driven dual-runtime parity...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82745

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

CVE-2026-82745: Improper Access Control

Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. Unlike a SQL data layer, whose unique primary-key constraint rejects a duplicate, the ET...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-69248 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-69249 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

A Security-Oriented Lifecycle Model for Large Language Model Systems

Large language models are being integrated into critical infrastructure and enterprise workflows at unprecedented scale,yet the lifecycle frameworks governing their development and operations were designed for operational efficiency rather than security analysis. As a result, security-relevant...

Malware in app-data-layer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-11052 Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

Malicious Package

Overview app-data-layer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-34073 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-26007 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-26007 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

CVE-2026-22219

CVE-2026-22219 affects Chainlit

CVE-2026-22219 Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element

Chainlit versions prior to 2.9.4 contain a server-side request forgery SSRF vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy...

Inside the attack chain: Threat activity targeting Azure Blob Storage

Azure Blob Storage, like any object data service, is a high-value target for threat actors due to its critical role in storing and managing massive amounts of unstructured data at scale across diverse workloads. Organizations of all sizes use Blob Storage to support key workloads—such as AI, high...

MAL-2025-6321 Malicious code in ui-data-layer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a48f1cd7920a46266b710e80c45543e765af5de9e2944c114bf249efe69ce17 The OpenSSF Package Analysis project identified 'ui-data-layer' @...