# Ash-Project vulnerabilities Source: https://junglewise.ai/threats/vendors/ash-project Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/ash-project.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 67 vulnerabilities in Ash-Project: 1 in the last 7 days and 62 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119613, was published on 9 November 2026. 5 vulnerabilities in the last four weeks, up 150% on the four before (2). 9 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 5 - Last 90 days: 62 - All time: 67 (0 critical, 0 exploited in the wild) ## Latest Ash-Project vulnerabilities - [CVE-2026-119613: ash-project ash_ai sensitive information disclosure in error messages](https://junglewise.ai/threats/cve-2026-119613-generation-of-error-message-containing-sensitive-information) (info, published 9 Nov 2026) - [CVE-2026-96581: ash authorization bypass via user-controlled key in upsert](https://junglewise.ai/threats/cve-2026-96581-authorization-bypass-through-user-controlled-key-vulnerability-in) (info, published 26 Oct 2026) - [CVE-2026-115635: ash-project ash_postgres incorrect authorization in upsert](https://junglewise.ai/threats/cve-2026-115635-incorrect-authorization-vulnerability-in-ash-project-ash) (info, published 25 Oct 2026) - [CVE-2026-115627: ash-project ash_postgres incorrect authorization in many-to-many relationships](https://junglewise.ai/threats/cve-2026-115627-incorrect-authorization-vulnerability-in-ash-project-ash) (info, published 25 Oct 2026) - [CVE-2026-114214: ash-project ash incorrect authorization in relationships](https://junglewise.ai/threats/cve-2026-114214-incorrect-authorization-vulnerability-in-ash-project-ash-allows) (info, published 25 Oct 2026) - [CVE-2026-105283: Ash TypeScript error message information disclosure](https://junglewise.ai/threats/cve-2026-105283-generation-of-error-message-containing-sensitive-information) (info, published 12 Oct 2026) - [CVE-2026-101028: Ash incorrect authorization in aggregate queries](https://junglewise.ai/threats/cve-2026-101028-incorrect-authorization-vulnerability-in-ash-project-ash-allows) (info, published 9 Oct 2026) - [CVE-2026-93477: ash Improperly Controlled Modification of Object Attributes in bulk actions](https://junglewise.ai/threats/cve-2026-93477-improperly-controlled-modification-of-dynamically-determined) (info, published 25 Sep 2026) - [CVE-2026-82710: ash-project usage_rules terminal escape sequence injection](https://junglewise.ai/threats/cve-2026-82710-ash-project-usage-rules-terminal-escape-sequence-injection) (info, published 8 Sep 2026) - [CVE-2026-82758: ash-project ash_authentication_oauth2_server authentication bypass in client registration](https://junglewise.ai/threats/cve-2026-82758-ash-project-ash-authentication-oauth2-server-authentication) (info, CVSS 7.5, published 7 Sep 2026) - [CVE-2026-82757: ash-project ash_authentication_oauth2_server SSRF in metadata fetch](https://junglewise.ai/threats/cve-2026-82757-ash-project-ash-authentication-oauth2-server-ssrf-in-metadata) (info, CVSS 6.5, published 7 Sep 2026) - [CVE-2026-82756: ash-project ash_authentication_oauth2_server parameter injection in WWW-Authenticate header](https://junglewise.ai/threats/cve-2026-82756-ash-project-ash-authentication-oauth2-server-parameter-injection) (info, published 7 Sep 2026) - [CVE-2026-82755: ash-project ash_authentication_oauth2_server cache poisoning in OAuth discovery metadata](https://junglewise.ai/threats/cve-2026-82755-ash-project-ash-authentication-oauth2-server-cache-poisoning-in) (info, published 7 Sep 2026) - [CVE-2026-82754: ash-project ash_authentication_oauth2_server path traversal in OAuth endpoints](https://junglewise.ai/threats/cve-2026-82754-ash-project-ash-authentication-oauth2-server-path-traversal-in) (info, published 7 Sep 2026) - [CVE-2026-82753: ash-project ash_authentication_oauth2_server unbound resource allocation in /authorize](https://junglewise.ai/threats/cve-2026-82753-ash-project-ash-authentication-oauth2-server-unbound-resource) (info, published 7 Sep 2026) - [CVE-2026-82586: ash-project ash_lua authorization bypass in aggregation read](https://junglewise.ai/threats/cve-2026-82586-ash-project-ash-lua-authorization-bypass-in-aggregation-read) (info, published 7 Sep 2026) - [CVE-2026-82584: ash-project igniter improper escape sequence neutralization in package confirmation panel](https://junglewise.ai/threats/cve-2026-82584-ash-project-igniter-improper-escape-sequence-neutralization-in) (info, published 7 Sep 2026) - [CVE-2026-81638: ash-project ash_double_entry ULID encoding bypass](https://junglewise.ai/threats/cve-2026-81638-ash-project-ash-double-entry-ulid-encoding-bypass) (info, published 7 Sep 2026) - [CVE-2026-82733: ash-project ash_typescript information disclosure in error responses](https://junglewise.ai/threats/cve-2026-82733-ash-project-ash-typescript-information-disclosure-in-error) (info, CVSS 7.5, published 1 Sep 2026) - [CVE-2026-82732: ash-project ash_typescript input validation bypass in TypedController](https://junglewise.ai/threats/cve-2026-82732-ash-project-ash-typescript-input-validation-bypass-in) (info, CVSS 7.5, published 1 Sep 2026) - [CVE-2026-82731: ash-project ash_typescript open redirect in typed controller routing](https://junglewise.ai/threats/cve-2026-82731-ash-project-ash-typescript-open-redirect-in-typed-controller) (info, CVSS 6.1, published 1 Sep 2026) - [CVE-2026-82730: ash-project ash_typescript unauthorized attribute disclosure in RPC](https://junglewise.ai/threats/cve-2026-82730-ash-project-ash-typescript-unauthorized-attribute-disclosure-in) (info, CVSS 5.3, published 1 Sep 2026) - [CVE-2026-77950: ash-project ash_typescript information disclosure in error handler](https://junglewise.ai/threats/cve-2026-77950-ash-project-ash-typescript-information-disclosure-in-error) (info, published 1 Sep 2026) - [CVE-2026-77856: ash-project ash_typescript DoS via atom table exhaustion](https://junglewise.ai/threats/cve-2026-77856-ash-project-ash-typescript-dos-via-atom-table-exhaustion) (info, published 1 Sep 2026) - [CVE-2026-74837: ash-project ash_typescript denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-74837-ash-project-ash-typescript-denial-of-service-via-resource) (info, CVSS 7.5, published 1 Sep 2026) ## Most severe Ash-Project vulnerabilities - [CVE-2026-34593: Ash Framework Denial of Service via Atom Exhaustion in Module Type](https://junglewise.ai/threats/cve-2026-34593-ash-framework-denial-of-service-via-atom-exhaustion-in-module) (high, CVSS 7.5, published 2 Apr 2026) - [CVE-2026-55736: Ash Framework private argument injection in Ash.Changeset](https://junglewise.ai/threats/cve-2026-55736-ash-framework-private-argument-injection-in-ash-changeset) (medium, CVSS 5.9, published 23 Jun 2026) - [CVE-2026-77956: ash-project ash_ai code injection in prompt evaluation](https://junglewise.ai/threats/cve-2026-77956-ash-project-ash-ai-code-injection-in-prompt-evaluation) (info, CVSS 9.8, published 31 Aug 2026) - [CVE-2025-48044: Ash Framework authorization bypass in bypass policy logic](https://junglewise.ai/threats/cve-2025-48044-ash-framework-authorization-bypass-in-bypass-policy-logic) (info, CVSS 8.6, published 17 Oct 2025) - [CVE-2025-48043: Ash Framework Authentication Bypass in Policy Authorizer](https://junglewise.ai/threats/cve-2025-48043-ash-framework-authentication-bypass-in-policy-authorizer) (info, CVSS 8.6, published 10 Oct 2025) - [CVE-2026-82673: ash-project ash_admin path traversal in file upload](https://junglewise.ai/threats/cve-2026-82673-ash-project-ash-admin-path-traversal-in-file-upload) (info, CVSS 8.2, published 31 Aug 2026) - [CVE-2026-82758: ash-project ash_authentication_oauth2_server authentication bypass in client registration](https://junglewise.ai/threats/cve-2026-82758-ash-project-ash-authentication-oauth2-server-authentication) (info, CVSS 7.5, published 7 Sep 2026) - [CVE-2026-82732: ash-project ash_typescript input validation bypass in TypedController](https://junglewise.ai/threats/cve-2026-82732-ash-project-ash-typescript-input-validation-bypass-in) (info, CVSS 7.5, published 1 Sep 2026) - [CVE-2026-82733: ash-project ash_typescript information disclosure in error responses](https://junglewise.ai/threats/cve-2026-82733-ash-project-ash-typescript-information-disclosure-in-error) (info, CVSS 7.5, published 1 Sep 2026) - [CVE-2026-74837: ash-project ash_typescript denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-74837-ash-project-ash-typescript-denial-of-service-via-resource) (info, CVSS 7.5, published 1 Sep 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up 150% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 20 | 0 | 0 | | 31 Aug 2026 | 24 | 0 | 0 | | 7 Sep 2026 | 10 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Ash-Project technologies - [Ash-Project Ash Typescript](https://junglewise.ai/threats/technologies/ash-typescript): 8 vulnerabilities - [Ash-Project Ash Admin](https://junglewise.ai/threats/technologies/ash-admin): 7 vulnerabilities - [Ash-Project Ash Ai](https://junglewise.ai/threats/technologies/ash-ai): 7 vulnerabilities - [Ash-Project Ash Authentication Oauth2 Server](https://junglewise.ai/threats/technologies/ash-authentication-oauth2-server): 6 vulnerabilities - [Ash-Project Ash Graphql](https://junglewise.ai/threats/technologies/ash-graphql): 5 vulnerabilities - [Ash-Project Ash Sql](https://junglewise.ai/threats/technologies/ash-sql): 5 vulnerabilities - [Ash-Project Ash Phoenix](https://junglewise.ai/threats/technologies/ash-phoenix): 4 vulnerabilities - [Ash-Project Ash](https://junglewise.ai/threats/technologies/ash-project-ash): 4 vulnerabilities - [Ash-Project Ash Postgres](https://junglewise.ai/threats/technologies/ash-postgres): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Ash-Project vulnerabilities", https://junglewise.ai/threats/vendors/ash-project, 12 November 2026.