Ash-project Ash Admin vulnerabilities

• ash-project ash admin Path traversal in AshAdmin file uploads via unsanitized client filename CVE-2026-82673 Fix available 8.3 HighAugust 31, 2026
• ash-project ash admin AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle CVE-2026-81853 Fix available 2.3 LowAugust 31, 2026
• ash-project ash admin AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass CVE-2026-81852 Fix available 2.1 LowAugust 31, 2026
• ash-project ash admin Query-parameter injection in AshAdmin row-action links via unencoded string primary keys CVE-2026-82681 Fix available 2.0 LowAugust 31, 2026
• ash-project ash admin Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVE-2026-77850 Fix available 8.4 HighAugust 31, 2026
• ash-project ash admin AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) CVE-2026-82722 Fix available 8.3 HighAugust 31, 2026
• ash-project ash admin AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain CVE-2026-75757 Fix available 8.3 HighAugust 31, 2026