CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

CVE-2026-82732

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

EUVD-2026-68927

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

CVE-2026-82732

ash_typescript (versions 0.15.0 through before 0.18.0) contains an improper input validation flaw in AshTypescript.TypedController.RequestHandler. The handler calls Ash.Type.cast_input/3 to coerce input but never invokes Ash.Type.apply_constraints/3, rendering declared constraints (one_of, max_le...

CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

PT-2026-84567

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. Chromium security severity: High...

CVE-2026-65891

CVE-2026-65891 — Joomla JCE Rename PoC Proof-of-concept scanner for CVE-2026-65891 in the Joomla Content Editor JCE extension. Improper input validation in the JCE file manager rename function allows an authenticated user with file-management permissions to: create hidden files dot-prefixed names...

cve_2024_0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

CVE-2026-83492

Extend Themes Kubio AI Website Builder (a WordPress plugin) is affected by an improper input validation vulnerability in versions prior to 2.9.1 . The flaw allows a high-privilege attacker to trigger a denial of service condition over the network with low complexity and no user interaction, resul...

EUVD-2026-68616

Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1...

CVE-2025-34157

Stored XSS in Coolify delete flow CVE-2025-34157 Affects: Coolify ≤ v4.0.0-beta.420.6 Fixed in: v4.0.0-beta.420.7 Severity: Critical 9.4 CVSS 4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site Scripting, CWE-20 Improper Input Validation Summary A...

c-CVE-2024-0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

CVE-2026-31156

CVE-2026-31156 Existe una vulnerabilidad de inyección de rutas en OpenPLC-v3, que surge de que el programa no realiza ninguna comprobación de validez sobre los parámetros de ruta de archivo pasados desde la línea de comandos. Los atacantes pueden leer cualquier archivo legible mediante la...

CVE-2025-70828

CVE-2025-70828 Resumen Se descubrió una vulnerabilidad de lectura arbitraria de archivos en Datart v1.0.0-rc.3. La aplicación no valida correctamente la URL de conexión JDBC durante la configuración de la fuente de datos. Detalles de la vulnerabilidad Tipo de vulnerabilidad: Validación de entrada...

CVE-2025-24963

CVE-2025-24963 - Vitest Browser Mode - Local File Read ​CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...

Blackash-CVE-2025-48593

🚨 CVE-2025-48593 Zero-Click Remote Code Execution in Android System 🚨 "A single malicious packet can own your device." — Android Security Team, Nov 2025 🎯 Vulnerability Snapshot Attribute| Details ---|--- CVE ID| CVE-2025-48593 Severity| 🔴 Critical RCE, Zero-Click CVSS Est.| 9.8 Pending NVD...

CVE-2026-81633

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-81633 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-81633 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-82550

A security flaw has been discovered in Linux Foundation Magma 1.9.0. This impacts an unknown function of the component NGSetupRequest Handler. Performing a manipulation of the argument NG-IoT-DefaultPagingDRX results in improper input validation. Remote exploitation of the attack is possible. The...