https://vulnogram.org/ Most recent CVEs assigned by Erlang Ecosystem Foundation (eef). https://vulnogram.org/seaview/icons/eef.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-105660 https://vulnogram.org/CVE-2026-105660 Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or… Medium Network Exploitable Thu, 15 Oct 2026 18:37:02 GMT https://vulnogram.org/CVE-2026-96596 https://vulnogram.org/CVE-2026-96596 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who suppl… Medium Wed, 14 Oct 2026 16:56:18 GMT https://vulnogram.org/CVE-2026-105236 https://vulnogram.org/CVE-2026-105236 Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 sess… Medium Network Exploitable Wed, 14 Oct 2026 16:55:51 GMT https://vulnogram.org/CVE-2026-94200 https://vulnogram.org/CVE-2026-94200 Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client… High Network Exploitable Wed, 14 Oct 2026 16:55:23 GMT https://vulnogram.org/CVE-2026-105659 https://vulnogram.org/CVE-2026-105659 Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or str… High Network Exploitable Wed, 14 Oct 2026 16:54:46 GMT https://vulnogram.org/CVE-2026-103061 https://vulnogram.org/CVE-2026-103061 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex… Medium Network Exploitable Mon, 12 Oct 2026 18:23:41 GMT https://vulnogram.org/CVE-2026-105274 https://vulnogram.org/CVE-2026-105274 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same c… Low Network Exploitable Mon, 12 Oct 2026 16:43:58 GMT https://vulnogram.org/CVE-2026-81856 https://vulnogram.org/CVE-2026-81856 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplie… Low Network Exploitable Mon, 12 Oct 2026 15:46:12 GMT https://vulnogram.org/CVE-2026-103060 https://vulnogram.org/CVE-2026-103060 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a d… High Network Exploitable Mon, 12 Oct 2026 15:43:57 GMT https://vulnogram.org/CVE-2026-96612 https://vulnogram.org/CVE-2026-96612 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a develop… High Network Exploitable Mon, 12 Oct 2026 15:39:49 GMT https://vulnogram.org/CVE-2026-105668 https://vulnogram.org/CVE-2026-105668 Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown (cooldown config, HEX_COOLDOWN)… High Mon, 12 Oct 2026 15:31:58 GMT https://vulnogram.org/CVE-2026-105280 https://vulnogram.org/CVE-2026-105280 Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and oute… Medium Network Exploitable Mon, 12 Oct 2026 15:30:14 GMT https://vulnogram.org/CVE-2026-96618 https://vulnogram.org/CVE-2026-96618 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.… Low Network Exploitable Mon, 12 Oct 2026 15:29:19 GMT https://vulnogram.org/CVE-2026-103503 https://vulnogram.org/CVE-2026-103503 Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path… Medium Network Exploitable Mon, 12 Oct 2026 15:17:45 GMT https://vulnogram.org/CVE-2026-103502 https://vulnogram.org/CVE-2026-103502 Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Er… Medium Network Exploitable Mon, 12 Oct 2026 13:15:29 GMT https://vulnogram.org/CVE-2026-105283 https://vulnogram.org/CVE-2026-105283 Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedica… Medium Network Exploitable Mon, 12 Oct 2026 11:16:30 GMT https://vulnogram.org/CVE-2026-97853 https://vulnogram.org/CVE-2026-97853 Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so… Medium Sat, 10 Oct 2026 19:43:45 GMT https://vulnogram.org/CVE-2026-104635 https://vulnogram.org/CVE-2026-104635 Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON wi… High Network Exploitable Fri, 09 Oct 2026 08:17:52 GMT https://vulnogram.org/CVE-2026-101028 https://vulnogram.org/CVE-2026-101028 Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the… Medium Fri, 09 Oct 2026 07:01:06 GMT https://vulnogram.org/CVE-2026-104634 https://vulnogram.org/CVE-2026-104634 Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.… Low Thu, 08 Oct 2026 13:41:05 GMT https://vulnogram.org/CVE-2026-88257 https://vulnogram.org/CVE-2026-88257 Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, r… Medium Thu, 08 Oct 2026 13:40:55 GMT https://vulnogram.org/CVE-2026-94206 https://vulnogram.org/CVE-2026-94206 Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much fast… Medium Network Exploitable Tue, 06 Oct 2026 08:38:04 GMT https://vulnogram.org/CVE-2026-95105 https://vulnogram.org/CVE-2026-95105 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak… High Network Exploitable Tue, 06 Oct 2026 08:37:56 GMT https://vulnogram.org/CVE-2026-94201 https://vulnogram.org/CVE-2026-94201 Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to t… High Network Exploitable Mon, 05 Oct 2026 19:19:51 GMT https://vulnogram.org/CVE-2026-94194 https://vulnogram.org/CVE-2026-94194 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses t… Medium Network Exploitable Mon, 28 Sep 2026 11:15:30 GMT https://vulnogram.org/CVE-2026-92103 https://vulnogram.org/CVE-2026-92103 Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.de… Medium Network Exploitable Mon, 28 Sep 2026 11:15:20 GMT https://vulnogram.org/CVE-2026-91043 https://vulnogram.org/CVE-2026-91043 Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's max_header_list_size setting… High Network Exploitable Mon, 28 Sep 2026 11:15:09 GMT https://vulnogram.org/CVE-2026-92106 https://vulnogram.org/CVE-2026-92106 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.to_html/2 and LazyHTML.Tree.to_html… Low Network Exploitable Fri, 25 Sep 2026 09:33:13 GMT https://vulnogram.org/CVE-2026-93477 https://vulnogram.org/CVE-2026-93477 Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with publ… Medium Fri, 25 Sep 2026 07:08:55 GMT https://vulnogram.org/CVE-2026-91187 https://vulnogram.org/CVE-2026-91187 Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strat… Critical Network Exploitable Thu, 24 Sep 2026 13:20:52 GMT https://vulnogram.org/CVE-2026-86698 https://vulnogram.org/CVE-2026-86698 Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained… Low Tue, 22 Sep 2026 15:51:57 GMT https://vulnogram.org/CVE-2026-87119 https://vulnogram.org/CVE-2026-87119 Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limi… High Network Exploitable Tue, 22 Sep 2026 11:16:56 GMT https://vulnogram.org/CVE-2026-89420 https://vulnogram.org/CVE-2026-89420 Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged. MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whos… High Tue, 22 Sep 2026 11:16:29 GMT https://vulnogram.org/CVE-2026-65634 https://vulnogram.org/CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rtt_ber:dec_subidentifi… High Network Exploitable Tue, 22 Sep 2026 08:49:24 GMT https://vulnogram.org/CVE-2026-68956 https://vulnogram.org/CVE-2026-68956 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of ssh_… High Tue, 22 Sep 2026 08:49:21 GMT https://vulnogram.org/CVE-2026-89422 https://vulnogram.org/CVE-2026-89422 Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes t… Critical Network Exploitable Tue, 22 Sep 2026 08:49:16 GMT https://vulnogram.org/CVE-2026-82672 https://vulnogram.org/CVE-2026-82672 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-q… Medium Network Exploitable Sat, 19 Sep 2026 17:00:31 GMT https://vulnogram.org/CVE-2026-86688 https://vulnogram.org/CVE-2026-86688 Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.store_in_session/… High Network Exploitable Thu, 17 Sep 2026 21:58:00 GMT https://vulnogram.org/CVE-2026-76949 https://vulnogram.org/CVE-2026-76949 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in a victim's browser to replace that victim's authenticated session with one for the attacker's own account. Ash… Critical Network Exploitable Thu, 17 Sep 2026 21:57:50 GMT https://vulnogram.org/CVE-2026-91039 https://vulnogram.org/CVE-2026-91039 Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection.… Critical Network Exploitable Thu, 17 Sep 2026 15:19:15 GMT https://vulnogram.org/CVE-2026-88952 https://vulnogram.org/CVE-2026-88952 Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matche… Critical Network Exploitable Thu, 17 Sep 2026 14:15:19 GMT https://vulnogram.org/CVE-2026-85500 https://vulnogram.org/CVE-2026-85500 Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.check_user/2 d… Critical Network Exploitable Thu, 17 Sep 2026 13:09:43 GMT https://vulnogram.org/CVE-2026-86533 https://vulnogram.org/CVE-2026-86533 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_presence_for_au… Critical Network Exploitable Thu, 17 Sep 2026 13:09:37 GMT https://vulnogram.org/CVE-2026-81632 https://vulnogram.org/CVE-2026-81632 Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a… High Thu, 17 Sep 2026 13:09:31 GMT https://vulnogram.org/CVE-2026-80218 https://vulnogram.org/CVE-2026-80218 Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPr… High Thu, 17 Sep 2026 13:09:25 GMT https://vulnogram.org/CVE-2026-78223 https://vulnogram.org/CVE-2026-78223 Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResourc… Medium Network Exploitable Thu, 17 Sep 2026 13:09:19 GMT https://vulnogram.org/CVE-2026-86522 https://vulnogram.org/CVE-2026-86522 Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthenti… Medium Network Exploitable Thu, 17 Sep 2026 13:09:11 GMT https://vulnogram.org/CVE-2026-81637 https://vulnogram.org/CVE-2026-81637 Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.O… Low Network Exploitable Thu, 17 Sep 2026 13:09:06 GMT https://vulnogram.org/CVE-2026-82761 https://vulnogram.org/CVE-2026-82761 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singl… Critical Network Exploitable Thu, 17 Sep 2026 13:09:01 GMT https://vulnogram.org/CVE-2026-82685 https://vulnogram.org/CVE-2026-82685 Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one… High Thu, 17 Sep 2026 13:08:56 GMT