ash-project ash_graphql

• CVE-2026-78693 Medium 6.9 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names 0.5%
• CVE-2026-80223 High 7.1 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read 0.4%
• CVE-2026-81636 High 8.7 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service 0.5%
• CVE-2026-81633 Medium 6.9 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment 0.5%
• CVE-2026-81643 Low 2.3 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification 0.4%
• CVE-2026-82367 Low 2.3 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic 0.4%