Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
EEF-CVE-2026-94206
  • Hex/cloak
  • Hex/cloak_ecto
  • github.com/danielberkompas/cloak
  • github.com/danielberkompas/cloak_ecto
 Cloak PBKDF2 field ignores the configured iteration count and runs only :size... yesterday
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-95105
  • Hex/cloak
  • github.com/danielberkompas/cloak
 Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext... yesterday
  • No fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-94201
  • Hex/ash
  • github.com/ash-project/ash
 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash 2 days ago
  • Fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-94194
  • Hex/mint
  • github.com/elixir-mint/mint
 Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries 28 Sep
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-92103
  • Hex/mint
  • github.com/elixir-mint/mint
 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size 28 Sep
  • Fix available
  • Severity - 6.3 (Medium)
EEF-CVE-2026-91043
  • Hex/mint
  • github.com/elixir-mint/mint
 HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory 28 Sep
  • Fix available
  • Severity - 8.2 (High)
GHSA-vj8p-hp9x-gh47
  • Hex/mpp
 mpp vulnerable to Gas Draining with low gas limit 25 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-qpxh-ff8m-c62v
  • Hex/mpp
 mpp vulnerable to Gas Draining with access list 25 Sep
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-vv77-66rf-pm86
  • Hex/mpp
 mpp vulnerable to Gas Draining with no limit 25 Sep
  • Fix available
  • Severity - 8.8 (High)
EEF-CVE-2026-92106
  • Hex/lazy_html
  • github.com/dashbitco/lazy_html
 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS 25 Sep
  • Fix available
  • Severity - 2.3 (Low)
EEF-CVE-2026-93477
  • Hex/ash
  • github.com/ash-project/ash
 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 25 Sep
  • Fix available
  • Severity - 5.9 (Medium)
GHSA-f4hc-ppw9-4hhw
  • Hex/ash
 Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets 24 Sep
  • Fix available
  • Severity - 5.9 (Medium)
EEF-CVE-2026-91187
  • Hex/nimble_zta
  • github.com/dashbitco/nimble_zta
 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy 24 Sep
  • Fix available
  • Severity - 9.3 (Critical)
GHSA-j43x-5hjq-rgxf
  • Hex/plug
 Plug: quadratic-time decoding of nested query/body parameters enables denial of service 23 Sep
  • Fix available
  • Severity - 8.7 (High)
EEF-CVE-2026-87119
  • Hex/mpp
  • github.com/zenhive/mpp
 mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed 22 Sep
  • Fix available
  • Severity - 8.2 (High)
EEF-CVE-2026-89420
  • Hex/mpp
  • github.com/zenhive/mpp
 Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free 22 Sep
  • Fix available
  • Severity - 7.1 (High)
Load more...