Hex

1 CVEs across 3 Hex products. Browse Hex vulnerabilities, severities, and proof-of-concept exploits.

Hex products with known CVEs

ProductCVEs
Hexpm5
Hex3
Hex Core2
Hex CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-32148Medium5.92026-04-30Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfi…
CVE-2026-23940Medium6.52026-03-13Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out o…
CVE-2026-21622Critical9.82026-03-05Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset toke…
CVE-2026-21621Medium5.32026-03-05Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with…
CVE-2026-21619High7.52026-02-27Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang…
CVE-2026-23939High7.52026-02-26Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Re…
CVE-2026-21618Medium6.12026-01-19Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz…
CVE-2019-1000013High8.82019-02-04Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modi…
CVE-2019-1000012High8.82019-02-04Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modificat…