Hex CVE feed and alerts
Every new CVE and security advisory affecting Hex packages, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 14
- High
- 67
- On CISA KEV
- 0
Of the newest 200
- CVE-2026-124279gRPC Server denial of service in Elixir streaming request body limitselixir-grpc grpc_server · grpc_server
- CVE-2026-121809Denial of service in streaming RPC handlingelixir-grpc grpc_server · elixir-grpc grpc +2
- CVE-2026-124278Authorization bypass in HTTP-transcoded routeselixir-grpc grpc_server · elixir-grpc grpc +2
- CVE-2026-121808Memory exhaustion in Erlpack codecelixir-grpc grpc · elixir-grpc grpc_core +2
- CVE-2026-123635gRPC Server denial of service via HTTP/2 flow-control leakelixir-grpc grpc_server · grpc_server
- CVE-2026-119613AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal detailsash-project ash_ai · ash_ai
- CVE-2026-71397Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_serverelixir-grpc grpc_server · grpc_server
- CVE-2026-115701Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustionninenines cowboy · cowboy
- CVE-2026-113431Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustionninenines cowlib · cowlib
- CVE-2026-66294XML injection in Saxy via unescaped CDATA section terminatorqcam saxy · saxy
- CVE-2026-66295Processing instruction target and content emitted unescaped in Saxy encoder allows XML injectionqcam saxy · saxy
- CVE-2026-66293XML comment injection in Saxy encoder via unescaped double hyphenqcam saxy · saxy
- CVE-2026-119434Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffersilviucpp ezstd · ezstd
- CVE-2026-118391Unbounded query cache growth from interpolated JSON paths and splice lists in Ectoelixir-ecto ecto · ecto
- CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeteam-alembic ash_authentication · ash_authentication
- CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceteam-alembic ash_authentication · ash_authentication
- CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountteam-alembic ash_authentication · ash_authentication
- CVE-2026-117680jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and notlud jsv · jsv
- CVE-2026-117656Unverified Sign in with Apple callback parameter can override verified ID token claimspow-auth assent · assent
- CVE-2026-117645Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1phoenixframework phoenix_html · phoenix_html
- CVE-2026-117666ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundarydeadtrickster ssl_verify_fun · ssl_verify_fun
- CVE-2026-116078HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Banditmtrudel bandit · bandit
- CVE-2026-109823Host filesystem path disclosure via DNS rebindingtidewave-ai tidewave · tidewave
- CVE-2026-65630Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in josepotatosalad jose · jose
- CVE-2026-65632ECDSA signature length is not validated in jose, allowing signature malleabilitypotatosalad jose · jose
- CVE-2026-65631erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of servicepotatosalad jose · jose
- CVE-2026-65629Weak PBKDF2 parameters for password-encrypted private-key export in josepotatosalad jose · jose
- CVE-2026-65628Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key typespotatosalad jose · jose
- CVE-2026-65627Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2potatosalad jose · jose
- CVE-2026-65626Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in josepotatosalad jose · jose
- CVE-2026-65625Attacker-controlled AES-GCM authentication tag length allows tag forgery in josepotatosalad jose · jose
- CVE-2026-97200Unbounded response body buffering and decompression in hackneybenoitc hackney · hackney
- CVE-2026-115693Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackneybenoitc hackney · hackney
- CVE-2026-113440HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackneybenoitc hackney · hackney
- CVE-2026-115700SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackneybenoitc hackney · hackney
- CVE-2026-112880CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackneybenoitc hackney · hackney
- CVE-2026-108529SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Banditmtrudel bandit · bandit
- CVE-2026-110499Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Banditmtrudel bandit · bandit
- CVE-2026-109584HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Banditmtrudel bandit · bandit
- CVE-2026-111103HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Banditmtrudel bandit · bandit
- CVE-2026-111101HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Banditmtrudel bandit · bandit
- CVE-2026-113436Quadratic bignum parsing of Content-Length and Host port values in Banditmtrudel bandit · bandit
- CVE-2026-110314WebSocket frames keep reaching the WebSock after a server-initiated close in Banditmtrudel bandit · bandit
- CVE-2026-114213WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Banditmtrudel bandit · bandit
- CVE-2026-114216Chunk extensions accept bare LF and CR, enabling request smuggling in Banditmtrudel bandit · bandit
- CVE-2026-115269HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Banditmtrudel bandit · bandit
- CVE-2026-108525HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Banditmtrudel bandit · bandit
- CVE-2026-96581An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's recordsash-project ash · ash
- CVE-2026-115627AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsash-project ash_postgres · ash_postgres
- CVE-2026-115635AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setash-project ash_postgres · ash_postgres
Show all 200 entriesShow fewer entries
- CVE-2026-114214Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsash-project ash · ash
- CVE-2026-107685WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackersagentjido req_llm · req_llm
- CVE-2026-105963Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentselixir-plug plug · elixir-plug plug_crypto +2
- EEF-CVE-2026-111497Out-of-bounds write in the Brotli decoder bundled with erl-brotlibrotli
- CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-86696Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-105270Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath esaml · handnot2 esaml +2
- CVE-2026-105660Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Banditmtrudel bandit · bandit
- CVE-2026-96596erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeerlang rebar3 · hexpm hex_core +3
- CVE-2026-105659HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Banditmtrudel bandit · bandit
- CVE-2026-105274hex_core decompresses registry and Erlang term API responses without size limitshexpm hex_core · erlang rebar3 +2
- CVE-2026-103502hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25hexpm hex_core · hex_core
- CVE-2026-105283Internal error terms inspected into AshTypescript RPC error responsesash-project ash_typescript · ash_typescript
- CVE-2026-97853Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSericmj decimal · decimal
- CVE-2026-104635Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messageselixir-protobuf protobuf · protobuf
- CVE-2026-101028Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sortsash-project ash · ash
- CVE-2026-104634beam_mcp: JSON boolean and null tool arguments reach dispatch as stringsScriptKittyOS beam_mcp · beam_mcp
- CVE-2026-88257beam_mcp: nested tool argument constraints advertised but not enforcedScriptKittyOS beam_mcp · beam_mcp
- CVE-2026-94206Cloak PBKDF2 field ignores the configured iteration count and runs only :size roundsdanielberkompas cloak_ecto · danielberkompas cloak +2
- CVE-2026-95105Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flippingdanielberkompas cloak · cloak
- CVE-2026-94201Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ashash-project ash · ash
- CVE-2026-94194Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediarieselixir-mint mint · mint
- CVE-2026-92103Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_sizeelixir-mint mint · mint
- CVE-2026-91043HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memoryelixir-mint mint · mint
- CVE-2026-92106lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSSdashbitco lazy_html · lazy_html
- CVE-2026-93477Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ashash-project ash · ash
- CVE-2026-91187Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategydashbit nimble_zta · nimble_zta
- CVE-2026-86698Refresh tokens accepted as private repository credentials at the CDNhexpm hex.pm · hexpm
- CVE-2026-87119mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayedZenHive mpp · mpp
- CVE-2026-89420Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for freeZenHive mpp · mpp
- CVE-2026-82672Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connectionselixir-mint mint · mint
- CVE-2026-86688Session id is not renewed on authentication in ash_authentication, allowing session fixationteam-alembic ash_authentication · ash_authentication
- CVE-2026-76949Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacementteam-alembic ash_authentication · ash_authentication
- CVE-2026-54451Elixir protobuf: Unbounded recursion depth in embedded-message decodingelixir-protobuf protobuf · protobuf
- CVE-2026-91039dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeoverteam-alembic ash_authentication · ash_authentication
- CVE-2026-88952OAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-85500require_confirmed_with is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-86533Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenixteam-alembic ash_authentication · team-alembic ash_authe… +2
- CVE-2026-81632Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixteam-alembic ash_authentication_phoenix · team-alembic a… +2
- CVE-2026-80218Sign-in token minted for one resource accepted by another in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-78223Token revocation record built from unverified JWT claims in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-86522Log injection via an unescaped password reset identity in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-81637Replayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-82761Magic link single-use tokens replayable via TOCTOU race in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-82685Confirmation token accepted on any record in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-82760Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inteam-alembic ash_authentication · ash_authentication
- CVE-2026-82759Reversible IP address pseudonymisation in AshAuthentication audit log hash modeteam-alembic ash_authentication · ash_authentication
- CVE-2026-82723Actor record with password digest stored in AshAuthentication audit log entriesteam-alembic ash_authentication · ash_authentication
- CVE-2026-86338Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracleash-project ash · ash
- CVE-2026-88255Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transactionZenHive mpp · mpp
- CVE-2026-89186Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paidZenHive mpp · mpp
- CVE-2026-77866SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hostsSlab safeurl · safeurl
- CVE-2026-77972safeurl validated address is not bound to the request, allowing DNS rebindingSlab safeurl · safeurl
- CVE-2026-78216AshLua eval read operations can read field-policy-protected fields via aggregatesash-project ash_lua · ash_lua
- CVE-2026-78230AshAi aggregate tool can read field-policy-protected fieldsash-project ash_ai · ash_ai
- CVE-2026-82710Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadataash-project usage_rules · usage_rules
- CVE-2026-82584Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadataash-project igniter · igniter
- CVE-2026-82586AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesash-project ash_lua · ash_lua
- CVE-2026-81638Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entryash-project ash_double_entry · ash_double_entry
- CVE-2026-82758ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpointash-project ash_authentication_oauth2_server · ash_authenti…
- CVE-2026-82757ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRFash-project ash_authentication_oauth2_server · ash_authenti…
- CVE-2026-82756Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the…ash-project ash_authentication_oauth2_server · ash_authenti…
- CVE-2026-82755ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusionash-project ash_authentication_oauth2_server · ash_authenti…
- CVE-2026-82754ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsash-project ash_authentication_oauth2_server · ash_authenti…
- CVE-2026-82753Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverash-project ash_authentication_oauth2_server · ash_authenti…
- CVE-2026-82750Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegationZenHive mpp · mpp
- CVE-2026-82751Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioningZenHive mpp · mpp
- CVE-2026-82752Ash string length constraints count graphemes, so a combining-mark string of any size passes max_lengthash-project ash · ash
- CVE-2026-82728Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSelixir-mint mint · mint
- CVE-2026-82729Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoSelixir-mint mint · mint
- CVE-2026-82747Ash.Policy.Authorizer returns records denied by a runtime read policy to any actorash-project ash · ash
- CVE-2026-82749Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped recordsash-project ash · ash
- CVE-2026-82748Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under anotherash-project ash · ash
- CVE-2026-82746Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsash-project ash · ash
- CVE-2026-82745ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniquenessash-project ash · ash
- CVE-2026-82744Ash.Reactor change step fails open, skipping a change when its where guard raisesash-project ash · ash
- CVE-2026-82743Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async readsash-project ash · ash
- CVE-2026-82742Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memoryash-project ash · ash
- CVE-2026-82741Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionash-project ash · ash
- CVE-2026-82740Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputsash-project ash · ash
- CVE-2026-82739Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch errorash-project ash · ash
- CVE-2026-82738Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of serviceash-project ash · ash
- CVE-2026-82737Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing readsash-project ash · ash
- CVE-2026-82736Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypassash-project ash · ash
- CVE-2026-82735Match regex runs on over-length input in Ash.Type.String, enabling regex denial of serviceash-project ash · ash
- CVE-2026-82734Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimalash-project ash · ash
- CVE-2026-82731Unescaped path parameters in AshTypescript generated TypeScript client allow request redirectionash-project ash_typescript · ash_typescript
- CVE-2026-74837Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatterash-project ash_typescript · ash_typescript
- CVE-2026-82733Route handler return value echoed into AshTypescript error responseash-project ash_typescript · ash_typescript
- CVE-2026-82732Declared argument constraints not enforced on AshTypescript typed controller routesash-project ash_typescript · ash_typescript
- CVE-2026-82730Authorization-redacted field values disclosed through AshTypescript result normalizationash-project ash_typescript · ash_typescript
- CVE-2026-77950RPC error handler fails open in AshTypescript, disclosing unredacted errorsash-project ash_typescript · ash_typescript
- CVE-2026-77856Unbounded atom creation from typed struct field names in AshTypescript field selectorash-project ash_typescript · ash_typescript
- CVE-2026-82725AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related dataash-project ash_phoenix · ash_phoenix
- CVE-2026-82724Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomainash-project ash_phoenix · ash_phoenix
- CVE-2026-82726AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantash-project ash_phoenix · ash_phoenix
- CVE-2026-82727AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error messageash-project ash_phoenix · ash_phoenix
- CVE-2026-82673Path traversal in AshAdmin file uploads via unsanitized client filenameash-project ash_admin · ash_admin
- CVE-2026-81853AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracleash-project ash_admin · ash_admin
- CVE-2026-81852AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypassash-project ash_admin · ash_admin
- CVE-2026-82681Query-parameter injection in AshAdmin row-action links via unencoded string primary keysash-project ash_admin · ash_admin
- CVE-2026-77850Stored XSS in AshAdmin relationship typeahead via unescaped label_field contentash-project ash_admin · ash_admin
- CVE-2026-82722AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)ash-project ash_admin · ash_admin
- CVE-2026-75757AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomainash-project ash_admin · ash_admin
- CVE-2026-75760AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing errorash-project ash_ai · ash_ai
- CVE-2026-82580AshAi echoes raw tool exception messages into the conversation, disclosing internal detailsash-project ash_ai · ash_ai
- CVE-2026-82579AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of serviceash-project ash_ai · ash_ai
- CVE-2026-82564Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified recordsash-project ash_ai · ash_ai
- CVE-2026-81315MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto headerash-project ash_ai · ash_ai
- CVE-2026-77956EEx template evaluation of prompt content in AshAi enables remote code executionash-project ash_ai · ash_ai
- CVE-2026-78693Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field namesash-project ash_graphql · ash_graphql
- CVE-2026-80223Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped readash-project ash_graphql · ash_graphql
- CVE-2026-81636Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of serviceash-project ash_graphql · ash_graphql
- CVE-2026-81633Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segmentash-project ash_graphql · ash_graphql
- CVE-2026-81643Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notificationash-project ash_graphql · ash_graphql
- CVE-2026-82367Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicash-project ash_graphql · ash_graphql
- CVE-2026-81322Cloaked plaintext leaks through a non-sensitive action argument in AshCloakash-project ash_cloak · ash_cloak
- CVE-2026-81319Unsafe deserialization of decrypted terms enables node DoS in AshCloakash-project ash_cloak · ash_cloak
- CVE-2026-78699rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgresash-project ash_postgres · ash_postgres
- CVE-2026-77454exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSqlash-project ash_sql · ash_sql
- CVE-2026-81316Same-named aggregates with differing filters are conflated in AshSqlash-project ash_sql · ash_sql
- CVE-2026-81318Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSqlash-project ash_sql · ash_sql
- CVE-2026-78691Unescaped backslash allows LIKE wildcard injection in AshSql string searchash-project ash_sql · ash_sql
- CVE-2026-80227SQL string_trim removes only spaces, diverging from in-memory trimming in AshSqlash-project ash_sql · ash_sql
- CVE-2026-78228Unbounded handle_error recursion enables denial of service in AshOban triggersash-project ash_oban · ash_oban
- CVE-2026-78038Job argument injection via :args overrides primary_key and tenant in AshObanash-project ash_oban · ash_oban
- CVE-2026-77846JSON path injection via unescaped get_path segments in AshSqliteash-project ash_sqlite · ash_sqlite
- CVE-2026-75759Encrypted ID token or JARM response accepted without a nested signature in erlef oidccerlef oidcc · oidcc
- CVE-2026-77831Algorithmic-complexity denial of service in AshPaperTrail full-diff list trackingash-project ash_paper_trail · ash_paper_trail
- CVE-2026-77970Sensitive fields nested in embedded values are not redacted in AshPaperTrail versionsash-project ash_paper_trail · ash_paper_trail
- CVE-2026-75847Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrailash-project ash_paper_trail · ash_paper_trail
- CVE-2026-66353Doggo vulnerable to cross-site scripting via unescaped date field valueswoylie doggo · doggo
- CVE-2026-65633Purpose-limited JWT accepted as full bearer authentication in AshAuthenticationteam-alembic ash_authentication · ash_authentication
- CVE-2026-66882Reflected XSS in AshAuthentication confirmation and magic link interaction formsteam-alembic ash_authentication · ash_authentication
- CVE-2026-75554Explicit organization scopes survive token refresh after membership endshexpm hex.pm · hexpm
- CVE-2026-75542OAuth token exchange grants repository scopes for organizations the principal cannot accesshexpm hex.pm · hexpm
- CVE-2026-56813Cookie attribute injection in Plug.Conn.Cookies.encode/2elixir-plug plug · plug
- CVE-2026-56814Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)elixir-plug plug · plug
- CVE-2026-56811Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of servicephoenixframework phoenix · phoenix
- CVE-2026-54893Email-derived URL path injection in the Swoosh Microsoft Graph adapterswoosh
- CVE-2026-48853Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcelixir-grpc grpc · grpc
- CVE-2026-48599Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcodingelixir-grpc grpc · grpc
- CVE-2026-48854Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcelixir-grpc grpc · grpc
- CVE-2026-43966HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2ninenines cowlib · cowlib +2
- CVE-2026-48596CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injectionelixir-tesla tesla · tesla
- CVE-2026-48594Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compressionelixir-tesla tesla · tesla
- CVE-2026-48595Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectselixir-tesla tesla · tesla
- CVE-2026-48597Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mintelixir-tesla tesla · tesla
- CVE-2026-48598CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injectionelixir-tesla tesla · tesla
- CVE-2026-43969Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1ninenines cowlib · cowlib
Get alerts for new Hex CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?ecosystem=hex
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?ecosystem=hex in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?ecosystem=hex&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?ecosystem=hex&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest Hex packages CVEs?
The newest are CVE-2026-124279 (gRPC Server denial of service in Elixir streaming request body limits); CVE-2026-121809 (Denial of service in streaming RPC handling); CVE-2026-124278 (Authorization bypass in HTTP-transcoded routes).
Are any Hex packages CVEs being exploited?
None of the 200 newest Hex packages vulnerabilities are on CISA's Known Exploited Vulnerabilities list.
How many critical Hex packages CVEs are there?
14 of the 200 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-117656, CVE-2026-117666, CVE-2026-115693, CVE-2026-107685, CVE-2026-91187 and more.
How do I get alerts for new Hex packages CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of Hex CVEs?
Yes: https://cve.now/feed?ecosystem=hex. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get Hex CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?ecosystem=hex. For email, give the RSS URL to any RSS-to-email service.