Issued CVEs

CVE ID	Title	Packages	Severity	Published
CVE-2026-78038	Job argument injection via :args overrides primary_key and tenant in AshOban	Hex / ash_oban GitHub / ash-project/ash_oban	M 5.9	2026-08-30
CVE-2026-77846	JSON path injection via unescaped get_path segments in AshSqlite	Hex / ash_sqlite GitHub / ash-project/ash_sqlite	L 2.1	2026-08-30
CVE-2026-75759	Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc	Hex / oidcc GitHub / erlef/oidcc	H 7.6	2026-08-30
CVE-2026-77831	Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking	Hex / ash_paper_trail GitHub / ash-project/ash_paper_trail	L 2.1	2026-08-30
CVE-2026-77970	Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions	Hex / ash_paper_trail GitHub / ash-project/ash_paper_trail	M 5.9	2026-08-30
CVE-2026-75847	Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail	Hex / ash_paper_trail GitHub / ash-project/ash_paper_trail	M 5.9	2026-08-30
CVE-2026-75758	Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir	Elixir GitHub / elixir-lang/elixir	M 5.9	2026-08-28
CVE-2026-66353	Doggo vulnerable to cross-site scripting via unescaped date field values	Hex / doggo GitHub / woylie/doggo	M 5.3	2026-08-27
CVE-2026-65633	Purpose-limited JWT accepted as full bearer authentication in AshAuthentication	Hex / ash_authentication GitHub / team-alembic/ash_authentication	H 7.6	2026-08-25
CVE-2026-66882	Reflected XSS in AshAuthentication confirmation and magic link interaction forms	Hex / ash_authentication GitHub / team-alembic/ash_authentication	L 2.1	2026-08-25
CVE-2026-75554	Explicit organization scopes survive token refresh after membership ends	GitHub / hexpm/hexpm	L 2.3	2026-08-24
CVE-2026-75542	OAuth token exchange grants repository scopes for organizations the principal cannot access	GitHub / hexpm/hexpm	H 8.3	2026-08-24
CVE-2026-47079	Round-trip Corruption via Improper Entity Escaping in xml_builder	Hex / xml_builder GitHub / joshnuss/xml_builder	L 2.1	2026-08-21
CVE-2026-48590	Element and Attribute Names Injected Verbatim into XML Output in xml_builder	Hex / xml_builder GitHub / joshnuss/xml_builder	L 2.1	2026-08-21
CVE-2026-47080	CDATA Section Breakout via Unsanitised ]]> in xml_builder	Hex / xml_builder GitHub / joshnuss/xml_builder	L 2.1	2026-08-21
CVE-2026-75484	HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.9	2026-08-20
CVE-2026-74836	HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-08-20
CVE-2026-53424	Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions	Hex / samly GitHub / dropbox/samly GitHub / handnot2/samly	C 9.1	2026-08-20
CVE-2026-53425	Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses	Hex / samly GitHub / dropbox/samly GitHub / handnot2/samly	H 7.6	2026-08-20
CVE-2026-67581	On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay	Hex / mpp GitHub / zenhive/mpp	H 8.7	2026-08-19
CVE-2026-73541	Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain	Hex / mpp GitHub / zenhive/mpp	H 8.3	2026-08-19
CVE-2026-73136	Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay	Hex / mpp GitHub / zenhive/mpp	H 8.2	2026-08-19
CVE-2026-73829	Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race	Hex / mpp GitHub / zenhive/mpp	M 6.3	2026-08-19
CVE-2026-43971	Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1	Hex / cowlib GitHub / ninenines/cowlib	M 6.3	2026-08-18
CVE-2026-67579	Filter expression injection via forged keyset pagination cursor in Ash	Hex / ash GitHub / ash-project/ash	H 7.5	2026-08-12

CVE-2026-78038

Job argument injection via :args overrides primary_key and tenant in AshOban

Hex / ash_oban

GitHub / ash-project/ash_oban

M 5.9

2026-08-30

CVE-2026-77846

JSON path injection via unescaped get_path segments in AshSqlite

Hex / ash_sqlite

GitHub / ash-project/ash_sqlite

L 2.1

2026-08-30