Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
EEF-CVE-2026-107685
  • Hex/req_llm
  • github.com/agentjido/req_llm
 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth... 20 hours ago
  • Fix available
  • Severity - 9.1 (Critical)
EEF-CVE-2026-105963
  • Hex/plug
  • Hex/plug_crypto
  • github.com/elixir-plug/plug
  • github.com/elixir-plug/plug_crypto
 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto... 21 hours ago
  • Fix available
  • Severity - 5.1 (Medium)
EEF-CVE-2026-93471
  • Hex/esaml
  • github.com/arekinath/esaml
  • github.com/dropbox/esaml
  • github.com/handnot2/esaml
 Unbounded SAML message decompression in esaml allows memory exhaustion 2 days ago
  • No fix available
  • Severity - 8.7 (High)
EEF-CVE-2026-86696
  • Hex/esaml
  • github.com/arekinath/esaml
  • github.com/dropbox/esaml
  • github.com/handnot2/esaml
 Unbounded atom creation from unsigned LogoutResponse status codes in esaml... 2 days ago
  • No fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-105270
  • Hex/esaml
  • github.com/arekinath/esaml
  • github.com/dropbox/esaml
  • github.com/handnot2/esaml
 Unbounded atom creation while parsing SAML messages in esaml allows atom table... 2 days ago
  • No fix available
  • Severity - 8.7 (High)
GHSA-754j-98wh-57rf
  • Hex/swoosh
 swoosh has email-derived URL path injection in Microsoft Graph endpoint 16 Oct
  • Fix available
  • Severity - 2.1 (Low)
EEF-CVE-2026-105660
  • Hex/bandit
  • github.com/mtrudel/bandit
 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and... 15 Oct
  • Fix available
  • Severity - 6.9 (Medium)
EEF-CVE-2026-96596
  • Hex/hex_core
  • github.com/erlang/otp
  • github.com/erlang/rebar3
  • github.com/hexpm/hex
  • github.com/hexpm/hex_core
 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole 14 Oct
  • Fix available
  • Severity - 5.9 (Medium)
EEF-CVE-2026-105659
  • Hex/bandit
  • github.com/mtrudel/bandit
 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle... 14 Oct
  • Fix available
  • Severity - 8.7 (High)
EEF-CVE-2026-105274
  • Hex/hex_core
  • github.com/erlang/rebar3
  • github.com/hexpm/hex
  • github.com/hexpm/hex_core
 hex_core decompresses registry and Erlang term API responses without size... 12 Oct
  • Fix available
  • Severity - 2.1 (Low)
EEF-CVE-2026-103502
  • Hex/hex_core
  • github.com/hexpm/hex_core
 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and... 12 Oct
  • Fix available
  • Severity - 5.9 (Medium)
EEF-CVE-2026-105283
  • Hex/ash_typescript
  • github.com/ash-project/ash_typescript
 Internal error terms inspected into AshTypescript RPC error responses 12 Oct
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-97853
  • Hex/decimal
  • github.com/ericmj/decimal
 Unbounded allocation in decimal Decimal.round/3 driven by the places argument... 10 Oct
  • Fix available
  • Severity - 6.9 (Medium)
EEF-CVE-2026-104635
  • Hex/protobuf
  • github.com/elixir-protobuf/protobuf
 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of... 09 Oct
  • Fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-101028
  • Hex/ash
  • github.com/ash-project/ash
 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies... 09 Oct
  • Fix available
  • Severity - 6.0 (Medium)
EEF-CVE-2026-104634
  • Hex/beam_mcp
  • github.com/scriptkittyos/beam_mcp
 beam_mcp: JSON boolean and null tool arguments reach dispatch as strings 08 Oct
  • Fix available
  • Severity - 2.3 (Low)
Load more...