Hexpm
7 CVEs across 4 Hexpm products. Browse Hexpm vulnerabilities, severities, and proof-of-concept exploits.
Hexpm products with known CVEs
Hexpm CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-32148 | Medium | 5.9 | 2026-04-30 | Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfi… |
CVE-2026-23940 | Medium | 6.5 | 2026-03-13 | Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out o… |
CVE-2026-21622 | Critical | 9.8 | 2026-03-05 | Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.
Password reset toke… |
CVE-2026-21621 | Medium | 5.3 | 2026-03-05 | Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation.
An API key created with… |
CVE-2026-21619 | High | 7.5 | 2026-02-27 | Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang… |
CVE-2026-23939 | High | 7.5 | 2026-02-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Re… |
CVE-2026-21618 | Medium | 6.1 | 2026-01-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthoriz… |