Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
EEF-CVE-2026-94194
  • Hex/mint
  • github.com/elixir-mint/mint
 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries 3 days ago
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-92103
  • Hex/mint
  • github.com/elixir-mint/mint
 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size 3 days ago
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-91043
  • Hex/mint
  • github.com/elixir-mint/mint
 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory 3 days ago
  • Fix available
  • Severity - 8.2 (High)
GHSA-vj8p-hp9x-gh47
  • Hex/mpp
 mpp vulnerable to Gas Draining with low gas limit 6 days ago
  • Fix available
  • Severity - 8.8 (High)
GHSA-qpxh-ff8m-c62v
  • Hex/mpp
 mpp vulnerable to Gas Draining with access list 6 days ago
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-vv77-66rf-pm86
  • Hex/mpp
 mpp vulnerable to Gas Draining with no limit 6 days ago
  • Fix available
  • Severity - 8.8 (High)
EEF-CVE-2026-92106
  • Hex/lazy_html
  • github.com/dashbitco/lazy_html
 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS 25 Sep
  • Fix available
  • Severity - 2.3 (Low)
EEF-CVE-2026-93477
  • Hex/ash
  • github.com/ash-project/ash
 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 25 Sep
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-f4hc-ppw9-4hhw
  • Hex/ash
 Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets 24 Sep
  • Fix available
  • Severity - 5.9 (Medium)
EEF-CVE-2026-91187
  • Hex/nimble_zta
  • github.com/dashbitco/nimble_zta
 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy 24 Sep
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-j43x-5hjq-rgxf
  • Hex/plug
 Plug: quadratic-time decoding of nested query/body parameters enables denial of service 23 Sep
  • Fix available
  • Severity - 8.7 (High)
EEF-CVE-2026-87119
  • Hex/mpp
  • github.com/zenhive/mpp
 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed 22 Sep
  • Fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-89420
  • Hex/mpp
  • github.com/zenhive/mpp
 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free 22 Sep
  • Fix available
  • Severity - 7.1 (High)
EEF-CVE-2026-82672
  • Hex/mint
  • github.com/elixir-mint/mint
 Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections 19 Sep
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-86688
  • Hex/ash_authentication
  • github.com/team-alembic/ash_authentication
 Session id is not renewed on authentication in ash_authentication, allowing session fixation 17 Sep
  • Fix available
  • Severity - 7.4 (High)
EEF-CVE-2026-76949
  • Hex/ash_authentication
  • github.com/team-alembic/ash_authentication
 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement 17 Sep
  • Fix available
  • Severity - 9.1 (Critical)
Load more...