Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
EEF-CVE-2026-96596
  • Hex/hex_core
  • github.com/erlang/otp
  • github.com/erlang/rebar3
  • github.com/hexpm/hex
  • github.com/hexpm/hex_core
 erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole yesterday
  • Fix available
  • Severity - 5.9 (Medium)
EEF-CVE-2026-105659
  • Hex/bandit
  • github.com/mtrudel/bandit
 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle... yesterday
  • Fix available
  • Severity - 8.7 (High)
EEF-CVE-2026-105274
  • Hex/hex_core
  • github.com/erlang/rebar3
  • github.com/hexpm/hex
  • github.com/hexpm/hex_core
 hex_core decompresses registry and Erlang term API responses without size... 3 days ago
  • Fix available
  • Severity - 2.1 (Low)
EEF-CVE-2026-103502
  • Hex/hex_core
  • github.com/hexpm/hex_core
 hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and... 3 days ago
  • Fix available
  • Severity - 5.9 (Medium)
EEF-CVE-2026-105283
  • Hex/ash_typescript
  • github.com/ash-project/ash_typescript
 Internal error terms inspected into AshTypescript RPC error responses 3 days ago
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-97853
  • Hex/decimal
  • github.com/ericmj/decimal
 Unbounded allocation in decimal Decimal.round/3 driven by the places argument... 4 days ago
  • Fix available
  • Severity - 6.9 (Medium)
EEF-CVE-2026-104635
  • Hex/protobuf
  • github.com/elixir-protobuf/protobuf
 Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of... 6 days ago
  • Fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-101028
  • Hex/ash
  • github.com/ash-project/ash
 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies... 6 days ago
  • Fix available
  • Severity - 6.0 (Medium)
EEF-CVE-2026-104634
  • Hex/beam_mcp
  • github.com/scriptkittyos/beam_mcp
 beam_mcp: JSON boolean and null tool arguments reach dispatch as strings 08 Oct
  • Fix available
  • Severity - 2.3 (Low)
EEF-CVE-2026-88257
  • Hex/beam_mcp
  • github.com/scriptkittyos/beam_mcp
 beam_mcp: nested tool argument constraints advertised but not enforced 08 Oct
  • Fix available
  • Severity - 5.3 (Medium)
EEF-CVE-2026-94206
  • Hex/cloak
  • Hex/cloak_ecto
  • github.com/danielberkompas/cloak
  • github.com/danielberkompas/cloak_ecto
 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds 06 Oct
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-95105
  • Hex/cloak
  • github.com/danielberkompas/cloak
 Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping 06 Oct
  • No fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-94201
  • Hex/ash
  • github.com/ash-project/ash
 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash 05 Oct
  • Fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-94194
  • Hex/mint
  • github.com/elixir-mint/mint
 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries 28 Sep
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-92103
  • Hex/mint
  • github.com/elixir-mint/mint
 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size 28 Sep
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-91043
  • Hex/mint
  • github.com/elixir-mint/mint
 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory 28 Sep
  • Fix available
  • Severity - 8.2 (High)
Load more...