Jonatan Männchen / EEF

Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

SQL injection via the :comment option in Postgrex.stream/4

Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Reflected XSS in oaskit's default HTML error handler

Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys