Browse CVEs

MEDIUM 5.9 CVE-2026-32148 Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverif… Hex 2.4.2+ Fix from $1,6002026-04-30 MEDIUM 6.5 CVE-2026-23940 Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to… Hexpm 2026-03-09+ Fix from $1,6002026-03-13 CRITICAL 9.8 CVE-2026-21622 Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password … Hexpm 2026-03-05+ Fix from $2,3002026-03-05 MEDIUM 5.3 CVE-2026-21621 Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key cr… Hexpm 2026-03-05+ Fix from $1,6002026-03-05 HIGH 7.5 CVE-2026-23939 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module)… Hexpm 2026-02-26+ Fix from $1,9502026-02-26 MEDIUM 6.1 CVE-2026-21618 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.Shar… Hexpm 2026-01-19+ Fix from $1,6002026-01-19 HIGH 8.8 CVE-2019-1000012 Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package… Hex after 0.18.2 Fix from $1,9502019-02-04 HIGH 8.8 CVE-2019-1000013 Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Pa… Hex Core after 0.3.0 Fix from $1,9502019-02-04