18096 matches found
EEF-CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
Summary Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mappi...
EUVD-2026-68965
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...
CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...
EEF-CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
Summary Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores ...
CVE-2026-82732
Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...
EUVD-2026-68927
Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...
CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes
Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...
CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes
Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...
CVE-2026-82732
ash_typescript (versions 0.15.0 through before 0.18.0) contains an improper input validation flaw in AshTypescript.TypedController.RequestHandler. The handler calls Ash.Type.cast_input/3 to coerce input but never invokes Ash.Type.apply_constraints/3, rendering declared constraints (one_of, max_le...
EEF-CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes
Summary Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex cal...
CVE-2026-82738: Improper Input Validation
Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...
CVE-2026-82732: Improper Input Validation
Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...
CVE-2026-82740: Improper Input Validation
Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested :array, :array, type attribute, letting invalid input pass validation. Ash.Type.applyconstraints/3 lib/ash/type/type.ex handled the :array, :array, type case by mapping only...
PUB-A-469414216
In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-82741: Improper Validation of Specified Type of Input
Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :mapwithtag, bypassing that member's validation and any tag-based authorization. For a union with storage: :mapwithtag, each...
PT-2026-84080
Improper Input Validation vulnerability in ash-project ash typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ash typescript/typed controller/request handler.ex calls...
PT-2026-84567
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Improper input validation in the Omnibox allows a remote attacker to bypass the web origin policy through crafted network traffic, typically leveraging social engineering. Recommendatio...
PUB-A-510463247
In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...
ASB-A-329233015
In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...