T
Vendor security profile
team-alembic
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs19
Critical6
CISA KEV0
Public exploit2
Patch rate%100
Avg. CVSS6.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
2
16
0
CVE KEV
CVE severity distribution
19toplam CVE
Critical6 (32%)
High6 (32%)
Medium2 (11%)
Low5 (26%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%11
Public exploit
19Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
7.4
CVE-2026-86688
Session id is not renewed on authentication in ash_authentication, allowing session fixation
T
Patch verifiedEPSS %1
9.1
CVE-2026-76949
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
T
Patch verifiedEPSS %1
9.1
CVE-2026-91039
dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover
T
Patch verifiedEPSS %1
9.1
CVE-2026-88952
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
T
Patch verifiedEPSS %1
9.1
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
T
Patch verifiedEPSS %1
9.1
CVE-2026-86533
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
T
Patch verifiedEPSS %1
7.2
CVE-2026-81632
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
T
Patch verifiedEPSS %0
7.6
CVE-2026-80218
Sign-in token minted for one resource accepted by another in AshAuthentication
T
Patch verifiedEPSS %1
6.9
CVE-2026-78223
Token revocation record built from unverified JWT claims in AshAuthentication
T
Patch verifiedEPSS %0
6.3
CVE-2026-86522
Log injection via an unescaped password reset identity in AshAuthentication
T
Patch verifiedEPSS %1