74
CVEs
0
Critical
17
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
17
MEDIUM
31
LOW
26
Monthly CVE Trend
Affected Products (19)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77956 | Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests. | HIGH | 8.9 | 0.4% | 45 |
|
| CVE-2026-81636 | AshGraphql's Absinthe complexity calculator undercounts nested Relay connection and keyset pagination queries, allowing unauthenticated clients to bypass any configured `max_complexity` cap and force unbounded database reads. Versions 0.16.23 through 1.10.x expose this flaw whenever a schema uses `first`/`last`-based pagination: a single crafted query such as `posts(first: 500) { edges { node { comments(first: 500) { ... } } } }` scores near-zero in Absinthe's guard while materializing up to 250,000 records per request. No active exploitation is confirmed (no CISA KEV listing), but the attack requires no authentication and is trivially constructable from the public advisory description alone. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-74837 | Unauthenticated atom table exhaustion in ash_typescript 0.1.0-0.17.x allows any network attacker to crash the entire Erlang/BEAM node by submitting RPC requests with attacker-controlled field names. The library's `convert_to_field_atom/2` function calls `String.to_atom/1` on client-supplied strings without validation, minting permanent, non-garbage-collected atoms until the VM hits its table limit and aborts. Additionally, field names exceeding 255 characters trigger an uncaught `SystemLimitError`. No public exploit is identified at time of analysis, but exploitation is trivial given no authentication or special configuration is required. | HIGH | 8.7 | 0.3% | 44 |
|
| CVE-2026-77850 | Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access to execute arbitrary JavaScript in an administrator's browser. Affected are ash_admin versions 0.13.0 through 1.3.1, where the `RelationshipField` and `ManagedRelationshipSelectField` components render database record label fields unescaped via `Phoenix.HTML.raw/1` after applying search-term highlight markup. A crafted label such as `<img src=x onerror=...>` persists in the database and fires whenever an admin's typeahead dropdown displays the matching record, granting the attacker full admin-level privileges over everything AshAdmin exposes. No public exploit code has been identified at time of analysis; a vendor-released patch is available in version 1.3.1. | HIGH | 8.4 | 0.3% | 42 |
|
| CVE-2026-82673 | Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files. | HIGH | 8.3 | 0.6% | 42 |
|
| CVE-2026-75757 | Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used `new RegExp(name + "=([^;]+)")`, which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., `xactor_authorizing` over `actor_authorizing`) set from a sibling subdomain with `Domain=.example.com` to silently win. No public exploit or CISA KEV listing exists at time of analysis, but the integrity impact is high for any multi-subdomain deployment. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-82722 | Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin interface to crash the entire BEAM VM node. Two handlers - AshAdmin.PageLive's set_actor and AshAdmin.Components.Resource.Show's calculate - passed unvalidated client strings directly to Module.concat/1 and String.to_atom/1 respectively, minting a permanent new atom per unique request. Because BEAM atoms are never garbage collected and the table is capped at roughly one million entries, flooding either handler terminates the VM and takes down every Elixir application co-hosted on the node. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch version 1.3.1 is available. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-82753 | Unauthenticated resource exhaustion in ash_authentication_oauth2_server 0.3.0 enables any remote attacker to grow database storage and heap memory without bound when the Client ID Metadata Document (CIMD) feature is enabled. The /authorize endpoint's resolve_client/3 function fetches and permanently upserts one database row per distinct URL-shaped client_id, with no row cap, no TTL-based expiry, and no field-length limit; additionally, fetched documents enter CIMD.Cache before validation, meaning even rejected documents consume cache memory until their TTL expires. No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 8.2 | 0.4% | 41 |
|
| CVE-2026-82586 | Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-77856 | Unauthenticated BEAM atom table exhaustion in ash_typescript 0.11.0-0.17.x allows a remote attacker to abort the Erlang VM and take down the entire application node by sending RPC requests carrying many distinct, unrecognized field names targeting a typed struct field selector. The root cause is `resolve_typed_struct_field/2` calling `String.to_atom/1` on unresolvable client input before any field-existence validation, permanently minting atoms that the BEAM runtime never reclaims. A vendor-released patch is available in 0.18.0; no public exploit code or CISA KEV listing exists at time of analysis. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-82730 | Field policy enforcement in ash_typescript RPC serialization is bypassed by a missing pattern-match clause, allowing unauthenticated remote callers to receive the real values of attributes that Ash field policies explicitly denied. Any action returning an embedded resource through the RPC layer exposes policy-protected fields - including sensitive PII such as SSNs, as demonstrated in the patch test suite - inside the serialized JSON response. Affects ash_typescript 0.11.0 through 0.17.x; no public exploit code exists at time of analysis, but the attack path is fully described in the vendor advisory and the two-line fix diff. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-82724 | Tenant authorization bypass in ash_phoenix's SubdomainHook allows an authenticated user to cross tenant boundaries and access or modify data belonging to other tenants. The flaw is rooted in a LiveView lifecycle ordering error: AshPhoenix.LiveView.SubdomainHook.on_mount/4 called the consumer-defined authorization callback before Phoenix LiveView's handle_params phase had run, guaranteeing the callback always received a nil tenant and either crashed or silently permitted the request. Critically, the flawed check was never re-evaluated on subsequent in-session navigations, so the bypass persisted for the lifetime of the LiveView connection. No public exploit has been identified at time of analysis, but the bypass is systematic and total for all affected deployments using SubdomainHook with tenant-scoped authorization callbacks. | HIGH | 7.6 | 0.2% | 38 |
|
| CVE-2026-81315 | DNS-rebinding protection in AshAi.Mcp.Server (ash_ai 0.8.0-0.x) is bypassable because the default origin check trusts the attacker-controlled Host and X-Forwarded-Proto headers as proxies for TLS context. A malicious web page can exploit this to issue arbitrary cross-site requests to the victim's locally running MCP server, executing MCP calls under the victim's actor credentials. No public exploit has been identified at time of analysis, but the attack path is mechanically straightforward for any attacker who can lure a developer to a malicious page while they have the MCP server running locally. | HIGH | 7.4 | 0.2% | 37 |
|
| CVE-2026-78699 | Silent schema cross-contamination in ash_postgres multi-tenancy allows a low-privileged user who can trigger a tenant rename to gain unauthorized read and write access to a different tenant's PostgreSQL schema. Affected versions span 0.25.0 through 2.13.0 of the ash-project/ash_postgres Elixir library. When PostgreSQL rejects the ALTER SCHEMA rename due to a name collision, the library silently reports success, causing the tenant metadata row to be committed pointing at the victim's live schema - routing all subsequent reads and writes for the attacker's tenant against the victim's data. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.2 | 0.1% | 36 |
|
| CVE-2026-82564 | Authorization bypass in AshAi (ash_ai) versions 0.6.0 through pre-1.0.0 allows any authenticated tool caller to update or destroy database records it never legitimately identified, up to and including every row in a table. The flaw is in AshAi.Tool.Execution.identity_filter/3, which passes raw tool arguments directly into Ash.Query.do_filter/2; because Ash's filter DSL interprets map values as predicate expressions rather than scalar literals, a caller can inject filter logic such as {"not_eq": "<own-ref>"} to retarget bulk writes to arbitrary records. A vendor patch is available in commit 87f616d and the fix version is 1.0.0; no public exploit or CISA KEV listing exists at time of analysis. | HIGH | 7.1 | 0.3% | 36 |
|