CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

EUVD-2026-68288

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

EEF-CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

EUVD-2026-68282

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

OESA-2026-3549 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...

CVE-2026-81322: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

PT-2026-83629

Name of the Vulnerable Software and Affected Versions ash graphql versions 1.9.0 through 1.10.x Description A remote client can read internal field names that an application configured its error handler to redact. In AshGraphql.Errors, errors are processed by the error handler and merged using...

PT-2026-83545

Uncontrolled Recursion vulnerability in ash-project ash oban allows a user who can drive a trigger's on error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle error/4 runs the trigger's on error action on a job's final...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001502 advisory. In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in registerintccontroller In the error handling for this functio...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001494)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001494 advisory. In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in itsvpeirqdomainalloc...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001465)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001465 advisory. In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page sam4k working with Trend Micro Zero Day Initiative reported ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001456 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: st: fix probed platform device ref count on probe error path The probe function never...

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Summary In processPercentageRoyaltiesTransfer the royalty pool is collected from the sender by SubFromBalance that is ordered after the split loop and after if royaltiesToPay royaltiesToPay, so a split entry of exactly 100% PercentTransferPercentage = 10000 is a valid config: it drives...

GHSA-V358-WF77-39XV klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Summary In processPercentageRoyaltiesTransfer the royalty pool is collected from the sender by SubFromBalance that is ordered after the split loop and after if royaltiesToPay royaltiesToPay, so a split entry of exactly 100% PercentTransferPercentage = 10000 is a valid config: it drives...

CVE-2026-55763

CVE-2026-55763 affects Klever-Go (the Go implementation of the Klever blockchain), prior to version 1.7.19 . In processPercentageRoyaltiesTransfer (core/kapp/accounts/accounts.go), the sender's royalty debit via SubFromBalance is ordered after the split loop and after the royaltiesToPay

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...