Jonatan Männchen / EEF

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Path traversal in AshAdmin file uploads via unsanitized client filename

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir

Doggo vulnerable to cross-site scripting via unescaped date field values

Explicit organization scopes survive token refresh after membership ends

OAuth token exchange grants repository scopes for organizations the principal cannot access