A
Vendor security profile
ash-project
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs70
Critical0
CISA KEV0
Public exploit60
Patch rate%100
Avg. CVSS5.3
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
40
25
2
CVE KEV
CVE severity distribution
70toplam CVE
High20 (29%)
Medium26 (37%)
Low24 (34%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%86
Public exploit
70Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
6.0
CVE-2026-101028
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
A
Patch verifiedEPSS %0
8.2
CVE-2026-94201
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
A
Patch verifiedEPSS %0
5.9
CVE-2026-93477
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
A
Patch verifiedEPSS %0
6.0
CVE-2026-86338
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
A
Patch verifiedEPSS %0
5.9
CVE-2026-82747
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
A
Patch verifiedEPSS %0
5.9
CVE-2026-82749
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
A
Patch verifiedEPSS %0
2.1
CVE-2026-82748
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
A
Patch verifiedEPSS %0
5.9
CVE-2026-82746
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
A
Patch verifiedEPSS %0
5.9
CVE-2026-82745
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
A
Patch verifiedEPSS %0
2.1
CVE-2026-82744
Ash.Reactor change step fails open, skipping a change when its where guard raises
A
Patch verifiedEPSS %0