Login Request a demo
RE
Product
rebar3
by erlang · last CVE Oct 14, 2026
6
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 1High 3Medium 1Low 1
Severity
All severities6Critical1High3Medium1Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add rebar3 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-13802
9.8
7%
Sep 2
Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification
Affected: 3.1.0 through 3.13.2; 3.0.0; 3.0.0
CVE-2019-1000014
8.8
2%
Feb 4
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected,…
Affected: 3.7.0 through 3.7.5
CVE-2026-103060
7.5
0%
Oct 12
Path traversal in rebar3 via unvalidated dependency app names
Affected: 3.7.0-rc1 before 3.27.2; 56b7d88975aa8da6446857cfd92de0825024bf63 before e35282b26e499b1d9e8f30bba9dccd71cd8b02ba
CVE-2026-21619
7.5
1%
Feb 27
Unsafe Deserialization of Erlang Terms in hex_core
Affected: 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 before 1d4478f527e373de0b225951e53115450e0d9b9d; 3.9.1 before 3.27.0
CVE-2026-96596
5.9
0%
Oct 14
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Affected: 3.27.1 before 3.28.0; 23dbdb5d1f87f56902aef296c88a20049cd0c6e4 before 310e2ec8c7dd3df05d67af2b7fae23f30fc523c4
CVE-2026-105274
2.1
0%
Oct 12
hex_core decompresses registry and Erlang term API responses without size limits
Affected: 3.9.1 before 3.27.3; 209c02ec57c2cc3207ee0174c3af3675b8dc8f79 before 360838a22f5b3a88c0358207f2923059bcbb3afb
Showing 6