CVE-2026-81633

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-81633 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

EEF-CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Summary Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the...

CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319 Unsafe deserialization of decrypted terms enables node DoS in AshCloak

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319

CVE-2026-81319 is a deserialization of untrusted data flaw in ash_cloak (an Erlang/BEAM encryption library by ash-project), affecting versions 0.1.0 through before 0.4.0 . The root cause is that AshCloak.Calculations.Decrypt decodes the decrypted binary using Ash.Helpers.non_executable_binary_to_...

CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

PT-2026-83624

Deserialization of Untrusted Data vulnerability in ash-project ash cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypt...

PT-2026-83626

Name of the Vulnerable Software and Affected Versions ash graphql versions 0.27.0 through 1.10.9 Description Improper input validation allows an unauthenticated client to crash a relay nodeid: ... query. The AshGraphql.Graphql.Resolver.resolve node/2 function uses decode relay id/1 to decode a...

CVE-2026-81633: Improper Input Validation

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

MAL-2026-15570 Malicious code in node-net-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9c6bb87249429b2a3f3791589075bf872a433bd47a33b152f6809ccf94b1328 package.json declares a postinstall hook node index.js that runs automatically on npm install. The shipped index.js contains no networking or...

Malicious Package

Overview node-net-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in node-net-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9c6bb87249429b2a3f3791589075bf872a433bd47a33b152f6809ccf94b1328 package.json declares a postinstall hook node index.js that runs automatically on npm install. The shipped index.js contains no networking or...

CVE-2026-82473

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82473

KubeEdge CloudCore through 1.23.1 has a missing authentication flaw on its HTTPS node task status report endpoint (port 10002 ). An unauthenticated attacker can reach this endpoint to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking furt...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...