[ Vendor · 9 CVEs ]
hexpm
CVEs affecting hexpm published in the last 30 days, plus any hexpm CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96596 | 14 Oct 2026 | CVSS 5.9 | erlang rebar3Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module)… | |
| CVE-2026-105274 | 12 Oct 2026 | CVSS 2.1 | erlang rebar3Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server… | |
| CVE-2026-96612 | 12 Oct 2026 | CVSS 7.5 | hexpm hexImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to… | |
| CVE-2026-96618 | 12 Oct 2026 | CVSS 2.1 | hexpm hexImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory… | |
| CVE-2026-81856 | 12 Oct 2026 | CVSS 2.3 | hexpm hexImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository… | |
| CVE-2026-103503 | 12 Oct 2026 | CVSS 5.9 | hexpm hexImproper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex… | |
| CVE-2026-105280 | 12 Oct 2026 | CVSS 6.9 | hexpm hexImproper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch… | |
| CVE-2026-105668 | 12 Oct 2026 | CVSS 7.1 | hexpm hexProtection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get… | |
| CVE-2026-103502 | 12 Oct 2026 | CVSS 5.9 | hexpm hex_coreImproper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm… |