Login Request a demo
HE
Product
hex
by hexpm · last CVE Oct 14, 2026
10
CVEs
0
On KEV
7.5
Max CVSS
8
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 0High 3Medium 4Low 3
Severity
All severities10Critical0High3Medium4Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hex to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-105280
6.9
0%
Oct 12
Hex writes unverified package tarballs to standard output in mix hex.package fetch
Affected: 0.20.2 before 2.5.2; d1f5a085d9d4748e1f7d195e4bc39ebd77c28d9c
CVE-2026-96596
5.9
0%
Oct 14
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Affected: 2.4.2 before 2.5.3; 5543a1919c709d8eb2b317f62aad76ca1eed375c
CVE-2026-103503
5.9
0%
Oct 12
Hex trusts its bundled CA certificates when cacerts_path is set
Affected: 0.20.2 before 2.5.2; c9b26a46928bfcd546773571e09c1d05f4cd9fb7
CVE-2026-32148
5.9
0%
Apr 30
Lockfile checksums not verified in Hex allows dependency integrity bypass
Affected: 0.16.0 before 2.4.2; e01576f28c64af9fae6eb17e2dad30f6efcb303c before d7528c8199a1144511508bf3a6460026a5a14c8e
Showing 4