{"api_version":"v1","generated_at":"2026-10-08T04:05:00+00:00","product":{"cve_count":28,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-ash-project-ash-92c64ae6a5db","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/ash","name":"ash","next_cursor":null,"observations":[{"affected":"ash: 3.5.1 < 3.34.3, 2970ba3bd5d36d6ad04c731ac87385375d457147 < 5282f3f513053628cdd1bf2236ea22d975d934d4","affected_versions_present":true,"cve_id":"CVE-2026-94201","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-94201","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-10-06T13:41:22.142Z","patch_url":"","primary_source":"","published":"2026-10-05T19:19:51.326Z"},{"affected":"ash: 2.17.15 < 3.33.11, 8c17434803b2e91de522bdfbd0ca918e5d5898df < 6b7ac53a0a2532291eb940d7beaf0fbb2da6fc4f","affected_versions_present":true,"cve_id":"CVE-2026-93477","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-93477","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-25T13:26:42.369Z","patch_url":"","primary_source":"","published":"2026-09-25T07:08:55.191Z"},{"affected":"ash: 2.11.0-rc.0 < 3.33.4, 0b6d93c7c4637280b46ae66ea1d2eaf013701238 < b3d4503241f3deacb5ceb955e10a4fa927da0f67","affected_versions_present":true,"cve_id":"CVE-2026-86338","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-86338","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-16T14:49:17.203Z","patch_url":"","primary_source":"","published":"2026-09-16T08:28:44.114Z"},{"affected":"0.10.0 < 3.33.0; 05848d5f4affe60fddd812222a18ada080c0813b < *","affected_versions_present":true,"cve_id":"CVE-2026-82752","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82752","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-08T18:20:03.503Z","patch_url":"","primary_source":"","published":"2026-09-05T17:16:16.722Z"},{"affected":"3.4.44 < 3.32.2; f4a8ff53fd3b974468d73685cd3fc842ef893de3 < 6eddb8ab26e45023faf0c79ebd152bb40aefda02","affected_versions_present":true,"cve_id":"CVE-2026-82747","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82747","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:36:50.341Z","patch_url":"","primary_source":"","published":"2026-09-01T04:14:57.840Z"},{"affected":"3.13.2 < 3.32.2; 0ddff26e6e6bc6d182e1af2f98b431575e5b4179 < e52dad2c39a35f6f043f7324d26e4f4e2551dfd2","affected_versions_present":true,"cve_id":"CVE-2026-82749","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82749","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:38:27.534Z","patch_url":"","primary_source":"","published":"2026-09-01T03:54:12.716Z"},{"affected":"3.5.13 < 3.32.2; d2e99980380cad610dbab3c4167e85323244bc71 < 2d9b78b87d2dc72885a8aa1d660b478d42f749f7","affected_versions_present":true,"cve_id":"CVE-2026-82748","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82748","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T15:17:47.434Z","patch_url":"","primary_source":"","published":"2026-09-01T03:52:01.686Z"},{"affected":"3.29.0 < 3.32.2; 45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335 < ed4e656822ffe83f8e960d5de0b573c0d1ae7f29","affected_versions_present":true,"cve_id":"CVE-2026-82746","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82746","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T15:17:12.056Z","patch_url":"","primary_source":"","published":"2026-09-01T03:47:14.278Z"},{"affected":"0.4.0 < 3.32.2; 6dc699d8a683d542812b34a8c104cc90164add3a < 912e243196017c2a812c25905c2b1cc3bbb843fc","affected_versions_present":true,"cve_id":"CVE-2026-82745","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82745","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T15:16:38.003Z","patch_url":"","primary_source":"","published":"2026-09-01T03:42:28.309Z"},{"affected":"3.0.0-rc.17 < 3.32.2; 321f43bd05ad9544e693cbf797243693e51a6be4 < 6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc","affected_versions_present":true,"cve_id":"CVE-2026-82744","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82744","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T15:15:56.042Z","patch_url":"","primary_source":"","published":"2026-09-01T03:39:42.668Z"},{"affected":"2.19.0 < 3.32.2; c48cb08026cf56b1ac33209203bc9c00061b40b8 < 0a5ecd2ffdfa848afdeb8827f02982ef2a63a1cd","affected_versions_present":true,"cve_id":"CVE-2026-82743","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82743","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:40:17.592Z","patch_url":"","primary_source":"","published":"2026-09-01T03:37:24.292Z"},{"affected":"1.29.0-rc0 < 3.32.2; f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 < da07f009e889819ec410fa1f0f12534bfb9e21dd","affected_versions_present":true,"cve_id":"CVE-2026-82742","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82742","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:41:53.189Z","patch_url":"","primary_source":"","published":"2026-09-01T03:35:18.551Z"},{"affected":"2.14.18 < 3.32.2; b0bd2d23d979e731610327636f51da4981fcef68 < 8dbdaecd0f115f52e7c3f9a3e798617d6fbf5f7d","affected_versions_present":true,"cve_id":"CVE-2026-82741","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82741","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T15:13:10.142Z","patch_url":"","primary_source":"","published":"2026-09-01T03:33:03.442Z"},{"affected":"2.16.1 < 3.32.2; 7b50a401d85018371659e51c34c89d7e1d0c2ac9 < c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce","affected_versions_present":true,"cve_id":"CVE-2026-82740","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82740","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:42:58.541Z","patch_url":"","primary_source":"","published":"2026-09-01T03:29:11.804Z"},{"affected":"2.17.20 < 3.32.2; fadecf3ee95640bd3bc7298df4799e0375537fd2 < 7dfe5f0b1ba4267580ded947dc861351d4dc8e2b","affected_versions_present":true,"cve_id":"CVE-2026-82739","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82739","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:44:21.482Z","patch_url":"","primary_source":"","published":"2026-09-01T03:27:58.165Z"},{"affected":"3.6.3 < 3.32.2; 751d8a4d11564efbe358c90c8347f3a00eb60782 < c453cdc0b8570e86ffef0d10e136247f52b3ea76","affected_versions_present":true,"cve_id":"CVE-2026-82738","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82738","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:47:34.853Z","patch_url":"","primary_source":"","published":"2026-09-01T03:26:23.035Z"},{"affected":"2.14.13 < 3.32.2; e2855843ca4a9141dcd7f40f47227e13b43f0e00 < cef5eb7b0693f04d1699a36e02a4e09ce1e7bffe","affected_versions_present":true,"cve_id":"CVE-2026-82737","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82737","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T12:56:53.991Z","patch_url":"","primary_source":"","published":"2026-09-01T03:24:14.969Z"},{"affected":"1.29.0-rc0 < 3.32.2; f6f5d194bfc7802bd32e48bf2eabd2d97a0109a4 < d8320b0127c8ef453679d70e5dd23a9506951d21","affected_versions_present":true,"cve_id":"CVE-2026-82736","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82736","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T13:06:35.213Z","patch_url":"","primary_source":"","published":"2026-09-01T03:21:47.332Z"},{"affected":"0.10.0 < 3.32.2; 05848d5f4affe60fddd812222a18ada080c0813b < 14928412a1a94a69c47df8e98920d3a2b09cdec4","affected_versions_present":true,"cve_id":"CVE-2026-82735","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82735","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T13:11:14.176Z","patch_url":"","primary_source":"","published":"2026-09-01T03:19:36.579Z"},{"affected":"1.28.0 < 3.32.2; db6bdfcf1518c70d67975efb140cdeb2cb6a76e7 < 818087b1b3364f2af6f5460d6b01262ad0f69204","affected_versions_present":true,"cve_id":"CVE-2026-82734","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-82734","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-01T15:15:19.108Z","patch_url":"","primary_source":"","published":"2026-09-01T03:17:15.389Z"},{"affected":"1.17.0 < 3.31.3; f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9 < 91874dd5435bc0ffebd8a254acfa573b39b74520","affected_versions_present":true,"cve_id":"CVE-2026-67579","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-67579","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-08-13T12:44:48.074Z","patch_url":"https://github.com/ash-project/ash/security/advisories/GHSA-3gq3-9xm3-c8v3","primary_source":"","published":"2026-08-12T20:04:42.256Z"},{"affected":"1.52.0-rc.11 < 3.31.1; 571c138140e71cea24005189f45d7a63c8d2ed20 < 09f42593035bceb0f6153dd7ee45cc49d108300a","affected_versions_present":true,"cve_id":"CVE-2026-70395","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-70395","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-08-10T18:23:15.009Z","patch_url":"","primary_source":"","published":"2026-08-09T18:17:07.321Z"},{"affected":"1.17.0 < 3.31.1; f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9 < 1816b103af975221210478d61db20adcea700319","affected_versions_present":true,"cve_id":"CVE-2026-69659","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-69659","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-08-10T17:24:04.995Z","patch_url":"https://github.com/ash-project/ash/security/advisories/GHSA-j35q-v8h8-7mwq","primary_source":"","published":"2026-08-09T18:01:32.896Z"},{"affected":"3.0.0 < 3.29.3; 5967ed3a483ab949866e6d7b043b043e61703f17 < d9b3100219b3ea86d73202bf7368c03a7688efea","affected_versions_present":true,"cve_id":"CVE-2026-55736","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-55736","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-07-10T04:34:23.070Z","patch_url":"","primary_source":"","published":"2026-06-23T18:21:13.033Z"},{"affected":"< 3.22.0","affected_versions_present":true,"cve_id":"CVE-2026-34593","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-34593","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-04-03T13:04:09.413Z","patch_url":"","primary_source":"","published":"2026-04-02T17:42:26.459Z"},{"affected":"ash: 3.6.3 < 3.7.1, 79749c2685ea031ebb2de8cf60cc5edced6a8dd0 < 8b83efa225f657bfc3656ad8ee8485f9b2de923d","affected_versions_present":true,"cve_id":"CVE-2025-48044","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-48044","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-22T09:35:27.186Z","patch_url":"","primary_source":"","published":"2025-10-17T13:52:53.644Z"},{"affected":"ash: 0.1.1 < 3.6.2, 4c41344126b0aba09ec3085517000f8aefec299e < 66d81300065b970da0d2f4528354835d2418c7ae","affected_versions_present":true,"cve_id":"CVE-2025-48043","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-48043","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-22T09:37:17.763Z","patch_url":"","primary_source":"","published":"2025-10-10T15:57:29.225Z"},{"affected":"ash: 0.1.1 < 3.5.39, 4c41344126b0aba09ec3085517000f8aefec299e < 5d1b6a5d00771fd468a509778637527b5218be9a","affected_versions_present":true,"cve_id":"CVE-2025-48042","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-48042","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-22T09:31:50.903Z","patch_url":"","primary_source":"","published":"2025-09-07T16:01:01.470Z"}],"source_generated_at":"2026-10-07T06:21:30.017Z","vendor":"ash-project"}}