Hex vulnerabilities
339 vulnerabilities and 0 malicious packages in Hex. ash has the most reviewed advisories.
Most exploited Hex vulnerabilities
- CVE-2017-20166 Ecto missing `is_nil` requirement
- CVE-2021-43568 ecdsa-elixir fails to check signatures, vulnerable to message forging
- CVE-2017-1000212 alchemist.vim vulnerable to remote code execution
- CVE-2026-8467 Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
- CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
- CVE-2026-48853 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
- CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
- CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
- CVE-2026-107685 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
- CVE-2026-76949 Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
- CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
- CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
Hex packages with the most advisories
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.