CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child...

CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

Unchecked Return Value vulnerability in ash-project ashpostgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's schema to have their tenant record repointed at that other tenant's live schema, gaining access to its data...

CVE-2026-81318

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81316

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. AshSql.Aggregate.differentqueries?/2 reports...

CVE-2026-77454

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

CVE-2026-81318

ash-project ash_sql (an Elixir SQL adapter for the Ash framework) contains an incorrect authorization flaw in AshSql.AggregateQuery.add_single_aggs/5. When computing an aggregate over a distinct query , the outer query is rebuilt from query.from.source alone, dropping the query.prefix / query.fro...

CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the outer quer...

EEF-CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

Summary Incorrect Authorization vulnerability in ash-project ashsql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. When an aggregate is computed over a distinct query, AshSql.AggregateQuery.addsingleaggs/5 rebuilds the...

Uncaught Exception

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable, reached from...

Uncaught Exception

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer function in lib/utils.js, which calls obj.constructor.isBufferobj without checking that it is callable,...

PT-2026-83631

Name of the Vulnerable Software and Affected Versions ash graphql versions 0.16.23 through 1.10.9 Description An unauthenticated client can bypass the configured GraphQL query-complexity limit to force an unbounded database read. This occurs because the query complexity/3 function in...

PT-2026-83518

Name of the Vulnerable Software and Affected Versions ash sqlite versions 0.1.2-rc.0 through 0.2.17 Description Improper neutralization of special elements in data query logic allows an attacker to traverse into nested JSON data that the application did not intend to expose, potentially disclosin...

PT-2026-83626

Name of the Vulnerable Software and Affected Versions ash graphql versions 0.27.0 through 1.10.9 Description Improper input validation allows an unauthenticated client to crash a relay nodeid: ... query. The AshGraphql.Graphql.Resolver.resolve node/2 function uses decode relay id/1 to decode a...

CVE-2026-82562

Summary When qs.parse is called with comma: true and throwOnLimitExceeded: true, a comma-separated value under a bracket-push key a=1,2,3,4 is split into an array without being compared against arrayLimit, while the same value under a flat key a=1,2,3,4, an indexed key a0=, a nested key ab=, or a...

qs: qs: Denial of Service via array limit bypass in query string parsing

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

CVE-2026-82448

Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...