Jonatan Männchen / EEF

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service

Email-derived URL path injection in the Swoosh Microsoft Graph adapter

Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc

Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding