Login Request a demo
HE
Product
hex_core
by hexpm · last CVE Oct 14, 2026
4
CVEs
0
On KEV
7.5
Max CVSS
3
New 30D
Vulnerabilities4In the news0Timeline
Severity mix
Critical 0High 1Medium 2Low 1
Severity
All severities4Critical0High1Medium2Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hex_core to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-21619
7.5
1%
Feb 27
Unsafe Deserialization of Erlang Terms in hex_core
Affected: eb327f8edfe45507351e38cc0805aa12fa647f0b before cdf726095bca85ad2549d146df1e831ae93c2b13; 0.1.0 before 0.12.1
CVE-2026-96596
5.9
0%
Oct 14
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Affected: 0.14.0 before 0.20.1; 13bb9fbba418a406af614790b8d5cd458259ee70 before a2ece683e6e88a3ec95ad20b09aca426e08b372e
CVE-2026-103502
5.9
0%
Oct 12
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Affected: 0.1.0 before 0.20.0; fbb6d9de472e5edb8d6fb6b32a91cb266137892e before b7b3a42defb4ed8e20a5c68a4412ce68a95b7938
CVE-2026-105274
2.1
0%
Oct 12
hex_core decompresses registry and Erlang term API responses without size limits
Affected: 0.1.0 before 0.20.0; fbb6d9de472e5edb8d6fb6b32a91cb266137892e before ebe25d110717f6a3addba5232cd4a7dc1c76b628
Showing 4