Important: Red Hat Security Advisory: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

Important: Red Hat Security Advisory: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

EUVD-2026-68309

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

CVE-2026-75760

ash_ai (ash-project, Elixir) contains a sensitive information disclosure in AshAi.Changes.Vectorize . When the embedding provider call fails, the raw error term is inspected into a user-facing changeset error, potentially exposing the request URL , provider response body , and the outbound Author...

EEF-CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose...

EUVD-2026-68308

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

CVE-2026-82580

CVE-2026-82580 affects ash_ai (versions 0.6.0 through

EEF-CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result...

EUVD-2026-68304

Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3...

PT-2026-83691

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When...

PT-2026-83669

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

PT-2026-83666

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

RHEL 8 : xmlrpc-c (RHSA-2026:61235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61235 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

The vulnerability of the Bindings component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the Bindings component in Google Chrome and Microsoft Edge is related to type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...