Linux Distros Unpatched Vulnerability : CVE-2026-18701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by...

CVE-2026-81636

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

EUVD-2026-68286

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child...

CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81633

Improper Input Validation vulnerability in ash-project ashgraphql allows an unauthenticated client to crash a relay nodeid: ... query with an unhandled KeyError. AshGraphql.Graphql.Resolver.resolvenode/2 decodes the client-supplied global ID with decoderelayid/1, which only base64-decodes the...

CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-81318

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81316

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-77454

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

EUVD-2026-68196

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

EEF-CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Summary Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the...

EUVD-2026-68189

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318

ash-project ash_sql (an Elixir SQL adapter for the Ash framework) contains an incorrect authorization flaw in AshSql.AggregateQuery.add_single_aggs/5. When computing an aggregate over a distinct query , the outer query is rebuilt from query.from.source alone, dropping the query.prefix / query.fro...

CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...