# Hex


- [CVE-2017-20166](https://insights.sbomify.com/CVE-2017-20166/): Ecto missing `is_nil` requirement (critical 9.8)
- [CVE-2021-43568](https://insights.sbomify.com/CVE-2021-43568/): ecdsa-elixir fails to check signatures, vulnerable to message forging (critical 9.8)
- [CVE-2017-1000212](https://insights.sbomify.com/CVE-2017-1000212/): alchemist.vim vulnerable to remote code execution (critical 9.8)
- [CVE-2026-8467](https://insights.sbomify.com/CVE-2026-8467/): Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground (critical 9.5)
- [CVE-2026-91187](https://insights.sbomify.com/CVE-2026-91187/): Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy (critical 9.3)
- [CVE-2026-48853](https://insights.sbomify.com/CVE-2026-48853/): Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc (critical 9.2)
- [CVE-2026-49757](https://insights.sbomify.com/CVE-2026-49757/): OAuth2/OIDC account takeover in AshAuthentication via email-based user matching (critical 9.2)
- [CVE-2026-115693](https://insights.sbomify.com/CVE-2026-115693/): Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney (critical 9.1)
- [CVE-2026-107685](https://insights.sbomify.com/CVE-2026-107685/): WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers (critical 9.1)
- [CVE-2026-76949](https://insights.sbomify.com/CVE-2026-76949/): Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement (critical 9.1)
- [CVE-2026-82761](https://insights.sbomify.com/CVE-2026-82761/): Magic link single-use tokens replayable via TOCTOU race in AshAuthentication (critical 9.1)
- [CVE-2026-85500](https://insights.sbomify.com/CVE-2026-85500/): `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/hex/