Hex Hexpm
5 CVEs affecting Hex Hexpm. Latest disclosed: 2026-03-13. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21622 | Critical | 9.8 | 2026-03-05 | Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset toke… |
CVE-2026-23939 | High | 7.5 | 2026-02-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Re… |
CVE-2026-23940 | Medium | 6.5 | 2026-03-13 | Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out o… |
CVE-2026-21618 | Medium | 6.1 | 2026-01-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz… |
CVE-2026-21621 | Medium | 5.3 | 2026-03-05 | Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with… |