Login Request a demo
HE
Product
Hexpm
by Hex · last CVE Mar 13, 2026
5
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities5In the news0Timeline
Severity mix
Critical 1High 1Medium 3Low 0
Severity
All severities5Critical1High1Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Hexpm to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-21622
9.8
0%
Mar 5
Password Reset Tokens Do Not Expire
Affected: 2025-10-01 before 2026-03-05
CVE-2026-23939
7.5
0%
Feb 26
Path Traversal in Local File Store Backend
Affected: 2014-09-29 before 2026-02-26
CVE-2026-23940
6.5
0%
Mar 13
Denial of Service via Oversized Package Upload
Affected: before 2026-03-09
CVE-2026-21618
6.1
0%
Jan 19
Cross-site scripting (XSS) in OAuth Device Authorization screen
Affected: 2025-10-01 before 2026-01-19
CVE-2026-21621
5.3
0%
Mar 5
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
Affected: 2025-10-17 before 2026-03-05
Showing 5