CVE-2026-82748 Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against. Ash.Actions.Aggregate groups aggregates by their authorize?,...

EUVD-2026-68951

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

EEF-CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Summary Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic...

CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.updatemany/4. Ash.updatemany/4 runs as a single atomic statement a data-layer updatemany, for example a SQL MERGE whenever an atomic strategy is...

CVE-2026-82746

CVE-2026-82746 is a missing authorization flaw in the ash-project/ash Elixir framework affecting versions 3.29.0 through 3.32.1 . The Ash.update_many/4 function, when using the atomic strategy, executed a single data-layer statement (e.g., a SQL MERGE) that bypassed resource policies even with au...

CVE-2026-82730

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

EEF-CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Summary Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because...

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-82730

ash_typescript (v0.11.0

EUVD-2026-68926

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

PT-2026-84552

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the Actor component allows a remote attacker who has already compromised the renderer process to bypass the web origin policy through a specially crafted HTML...

CVE-2026-51768

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

PT-2026-84549

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to bypass the web origin policy, which is a security mechanism that...

EUVD-2026-69378

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the csbroker component...

PT-2026-84078

Incorrect Authorization vulnerability in ash-project ash typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in original value because...

CVE-2026-51768

CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...

PT-2026-84161

Name of the Vulnerable Software and Affected Versions Kyverno versions v1.9.0 through v1.12.7 Description A flaw exists in the policy exception handling when a policy is set to enforce mode and combined with two PolicyExceptions. The system incorrectly allows a less restrictive exception to take...

PT-2026-84565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in Navigation allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web origin polic...

PT-2026-84567

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Improper input validation in the Omnibox allows a remote attacker to bypass the web origin policy through crafted network traffic, typically leveraging social engineering. Recommendatio...