ash-project ash_admin

• CVE-2026-82673 High 8.3 Path traversal in AshAdmin file uploads via unsanitized client filename 0.8%
• CVE-2026-81853 Low 2.3 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle 0.4%
• CVE-2026-81852 Low 2.1 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass 0.5%
• CVE-2026-82681 Low 2.0 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys 0.5%
• CVE-2026-77850 High 8.4 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content 0.5%
• CVE-2026-82722 High 8.3 AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) 0.5%
• CVE-2026-75757 High 8.3 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain 0.5%