https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:45:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362514 EUVD-2026-362514 https://cve.radiocsirt.org/vuln/euvd-2026-362514 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82741 <p>Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member&#39;s validation and any tag-based authorization.</p> <p>For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member&#39;s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.</p> <p>This issue affects ash: from 2.14.18 before 3.32.2.</p> <p>Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member&#39;s validation and any tag-based authorization.</p> <p>For a union with storage: :map_with_tag, each member is identified in storage by a configured tag and tag_value. Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex) did not force the configured tag when writing the value, so a tag carried in the submitted value was persisted verbatim. An attacker can therefore store a value whose data belongs to one member but whose tag names a different member. On read the value is re-selected by its tag and treated as the incompatible member (a type confusion), bypassing the real member&#39;s constraints and any logic or policy that branches on the union tag. The fix drops any incoming tag and forces the configured tag value on dump.</p> <p>This issue affects ash: from 2.14.18 before 3.32.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-82741