What’s Vulnerable › Products

ash-project ash_admin vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your ash-project ash_admin version is affected

Latest ash-project ash_admin vulnerabilities

• CVE-2026-82722 — AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) (CVSS 8.3)
• CVE-2026-82681 — Query-parameter injection in AshAdmin row-action links via unencoded string primary keys (CVSS 2.0)
• CVE-2026-82673 — Path traversal in AshAdmin file uploads via unsanitized client filename (CVSS 8.3)
• CVE-2026-81853 — AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle (CVSS 2.3)
• CVE-2026-81852 — AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass (CVSS 2.1)
• CVE-2026-77850 — Stored XSS in AshAdmin relationship typeahead via unescaped label_field content (CVSS 8.4)
• CVE-2026-75757 — AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain (CVSS 8.3)