Vulnerabilidades en hexpm
19 resultadosCVE-2026-21619LOWUnsafe Deserialization of Erlang Terms in hex_coreEPSS 0.6%CVE-2026-23940HIGHDenial of Service via Oversized Package UploadEPSS 0.5%CVE-2026-23939MEDIUMPath Traversal in Local File Store BackendEPSS 0.5%CVE-2026-75542HIGHOAuth token exchange grants repository scopes for organizations the principal cannot accessEPSS 0.5%CVE-2026-105274LOWhex_core decompresses registry and Erlang term API responses without size limitsEPSS 0.4%CVE-2026-21622CRITICALPassword Reset Tokens Do Not ExpireEPSS 0.4%CVE-2026-96612HIGHPath traversal in Hex via unvalidated dependency app namesEPSS 0.4%CVE-2026-86698LOWRefresh tokens accepted as private repository credentials at the CDNEPSS 0.4%CVE-2026-75554LOWExplicit organization scopes survive token refresh after membership endsEPSS 0.4%CVE-2026-81856LOWTerminal escape sequence injection in Hex via unneutralized server-supplied outputEPSS 0.4%CVE-2026-21621HIGHImproper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full AccessEPSS 0.4%CVE-2026-105668HIGHHex release-age cooldown is lifted package-wide when the locked release is retiredEPSS 0.4%CVE-2026-96618LOWHex exhausts memory and disk on oversized or compressed responses from an untrusted mirrorEPSS 0.4%CVE-2026-21618HIGHCross-site scripting (XSS) in OAuth Device Authorization screenEPSS 0.3%CVE-2026-103502MEDIUMhex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25EPSS 0.2%CVE-2026-96596MEDIUMerl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeEPSS 0.2%CVE-2026-105280MEDIUMHex writes unverified package tarballs to standard output in mix hex.package fetchEPSS 0.2%CVE-2026-103503MEDIUMHex trusts its bundled CA certificates when cacerts_path is setEPSS 0.2%CVE-2026-32148HIGHLockfile checksums not verified in Hex allows dependency integrity bypassEPSS 0.2%