Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,702All CVEsplus 19,141 rejected
- 647Last 24 hours3,003 in the last 7 days
- 17,172Last 30 days1,609 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 21 | 39 | 27 | 0 | 87 | 91 |
| 2025 | 0 | 3 | 0 | 0 | 0 | 3 | 4 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-96581 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's recordsash-project · ash | High7.6 |
| CVE-2026-115627 | AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsash-project · ash_postgres | Medium6.0 |
| CVE-2026-115635 | AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setash-project · ash_postgres | Medium6.0 |
| CVE-2026-114214 | Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsash-project · ash | Medium6.0 |
| CVE-2026-105283 | Internal error terms inspected into AshTypescript RPC error responsesash-project · ash_typescript | Medium6.3 |
| CVE-2026-101028 | Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sortsash-project · ash | Medium6.0 |
| CVE-2026-94201 | Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ashash-project · ash | High8.2 |
| CVE-2026-93477 | Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ashash-project · ash | Medium5.9 |
| CVE-2026-86338 | Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracleash-project · ash | Medium6.0 |
| CVE-2026-78216 | AshLua eval read operations can read field-policy-protected fields via aggregatesash-project · ash_lua | Medium6.0 |
| CVE-2026-78230 | AshAi aggregate tool can read field-policy-protected fieldsash-project · ash_ai | Medium6.0 |
| CVE-2026-82710 | Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadataash-project · usage_rules | Low2.3 |
| CVE-2026-82584 | Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadataash-project · igniter | Low2.3 |
| CVE-2026-82586 | AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesash-project · ash_lua | High8.2 |
| CVE-2026-81638 | Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entryash-project · ash_double_entry | Low2.1 |
| CVE-2026-82758 | ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpointash-project · ash_authentication_oauth2_server | Medium6.3 |
| CVE-2026-82757 | ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRFash-project · ash_authentication_oauth2_server | Medium6.3 |
| CVE-2026-82756 | ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injectionash-project · ash_authentication_oauth2_server | Medium6.3 |
| CVE-2026-82755 | ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusionash-project · ash_authentication_oauth2_server | Medium6.3 |
| CVE-2026-82754 | ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsash-project · ash_authentication_oauth2_server | Medium6.3 |
| CVE-2026-82753 | Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverash-project · ash_authentication_oauth2_server | High8.2 |
| CVE-2026-82752 | Ash string length constraints count graphemes, so a combining-mark string of any size passes max_lengthash-project · ash | Medium5.9 |
| CVE-2026-82747 | Ash.Policy.Authorizer returns records denied by a runtime read policy to any actorash-project · ash | Medium5.9 |
| CVE-2026-82749 | Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped recordsash-project · ash | Medium5.9 |
| CVE-2026-82748 | Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under anotherash-project · ash | Low2.1 |
| CVE-2026-82746 | Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsash-project · ash | Medium5.9 |
| CVE-2026-82745 | ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniquenessash-project · ash | Medium5.9 |
| CVE-2026-82744 | Ash.Reactor change step fails open, skipping a change when its where guard raisesash-project · ash | Low2.1 |
| CVE-2026-82743 | Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async readsash-project · ash | Low2.1 |
| CVE-2026-82742 | Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memoryash-project · ash | Medium5.9 |
| CVE-2026-82741 | Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionash-project · ash | Low2.1 |
| CVE-2026-82740 | Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputsash-project · ash | Low2.1 |
| CVE-2026-82739 | Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch errorash-project · ash | Low2.1 |
| CVE-2026-82738 | Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of serviceash-project · ash | Medium5.9 |
| CVE-2026-82737 | Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing readsash-project · ash | Medium5.9 |
| CVE-2026-82736 | Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypassash-project · ash | Low2.1 |
| CVE-2026-82735 | Match regex runs on over-length input in Ash.Type.String, enabling regex denial of serviceash-project · ash | Medium5.9 |
| CVE-2026-82734 | Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimalash-project · ash | Low2.1 |
| CVE-2026-82731 | Unescaped path parameters in AshTypescript generated TypeScript client allow request redirectionash-project · ash_typescript | Low2.3 |
| CVE-2026-74837 | Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatterash-project · ash_typescript | High8.7 |
| CVE-2026-82733 | Route handler return value echoed into AshTypescript error responseash-project · ash_typescript | Medium6.3 |
| CVE-2026-82732 | Declared argument constraints not enforced on AshTypescript typed controller routesash-project · ash_typescript | Medium6.3 |
| CVE-2026-82730 | Authorization-redacted field values disclosed through AshTypescript result normalizationash-project · ash_typescript | High8.2 |
| CVE-2026-77950 | RPC error handler fails open in AshTypescript, disclosing unredacted errorsash-project · ash_typescript | Medium6.3 |
| CVE-2026-77856 | Unbounded atom creation from typed struct field names in AshTypescript field selectorash-project · ash_typescript | High8.2 |
| CVE-2026-82725 | AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related dataash-project · ash_phoenix | Low2.3 |
| CVE-2026-82724 | Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomainash-project · ash_phoenix | High7.6 |
| CVE-2026-82726 | AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantash-project · ash_phoenix | Medium6.3 |
| CVE-2026-82727 | AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error messageash-project · ash_phoenix | Low2.3 |
| CVE-2026-82673 | Path traversal in AshAdmin file uploads via unsanitized client filenameash-project · ash_admin | High8.3 |