Jonatan Männchen / EEF

Job argument injection via :args overrides primary_key and tenant in AshOban

JSON path injection via unescaped get_path segments in AshSqlite

Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Path traversal in AshAdmin file uploads via unsanitized client filename

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir