Hexpm

10 CVEs across 4 Hexpm products. Browse Hexpm vulnerabilities, severities, and proof-of-concept exploits.

Hexpm products with known CVEs

ProductCVEs
Hexpm8
Hex.pm4
Hex2
Hex Core1
Hexpm CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-866982026-09-22Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep r…
CVE-2026-755542026-08-24Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its pr…
CVE-2026-755422026-08-24Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organiza…
CVE-2026-32148Medium5.92026-04-30Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfi…
CVE-2026-23940Medium6.52026-03-13Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out…
CVE-2026-21622Critical9.82026-03-05Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover. Password reset toke…
CVE-2026-21621Medium5.32026-03-05Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation. An API key created with…
CVE-2026-21619High7.52026-02-27Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang…
CVE-2026-23939High7.52026-02-26Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Re…
CVE-2026-21618Medium6.12026-01-19Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz…