Jonatan Männchen / EEF

Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

Private action arguments can be set by user input in Ash

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

Unbounded memory allocation in highlight_lines range expansion in mdex

Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex