PkgSeer

Vulnerabilities

Last updated 1 hour ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
ash_authentication Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix Unknown 25 days ago 2 hours ago
ash_authentication_phoenix Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix Unknown 25 days ago 2 hours ago
ash_authentication OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication Unknown 25 days ago 2 hours ago
ash_authentication_phoenix Missing Session Revocation on Logout in ash_authentication_phoenix Unknown 1 year ago 21 days ago
ash_authentication Session id is not renewed on authentication in ash_authentication, allowing session fixation Unknown 25 days ago 25 days ago
ash_authentication Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement Unknown 25 days ago 25 days ago
ash_authentication dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover Unknown 25 days ago 25 days ago
ash_authentication Token revocation record built from unverified JWT claims in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix Unknown 25 days ago 25 days ago
ash_authentication_phoenix Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix Unknown 25 days ago 25 days ago
ash_authentication Confirmation token accepted on any record in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication Reversible IP address pseudonymisation in AshAuthentication audit log hash mode Unknown 25 days ago 25 days ago
ash_authentication Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in Unknown 25 days ago 25 days ago
ash_authentication Sign-in token minted for one resource accepted by another in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication Actor record with password digest stored in AshAuthentication audit log entries Unknown 25 days ago 25 days ago
ash_authentication Magic link single-use tokens replayable via TOCTOU race in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication Log injection via an unescaped password reset identity in AshAuthentication Unknown 25 days ago 25 days ago
ash_authentication_oauth2_server ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion Unknown 1 month ago 1 month ago
ash_authentication Purpose-limited JWT accepted as full bearer authentication in AshAuthentication Unknown 1 month ago 1 month ago
ash_authentication Reflected XSS in AshAuthentication confirmation and magic link interaction forms Unknown 1 month ago 1 month ago
ash_authentication AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching Critical 9.5 1 month ago 1 month ago
ash_authentication OAuth2/OIDC account takeover in AshAuthentication via email-based user matching Unknown 4 months ago 2 months ago
ash_authentication_phoenix ash_authentication_phoenix has Insufficient Session Expiration Low Risk 3.0 1 year ago 6 months ago
ash_authentication ash_authentication has email link auto-click account confirmation vulnerability Medium Risk 5.3 1 year ago 10 months ago
ash_authentication Ash Authentication has flawed token revocation checking logic in actions generated by `mix ash_authentication.install` Medium Risk 6.0 1 year ago 10 months ago
Data courtesy of OSV.dev
Page 1