HE
Product
hexpm
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 3Low 2
Watch
Add hexpm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21622 | 9.8 | Mar 5 | Password Reset Tokens Do Not Expire Affected: 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884 |
| CVE-2026-75542 | 8.3 | Aug 24 | OAuth token exchange grants repository scopes for organizations the principal cannot access Affected: 2025-10-18 before 2026-08-24; 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b before bf0fb9d208f0acfabf7a2f7467c8231659e322a8 |
| CVE-2026-23939 | 7.5 | Feb 26 | Path Traversal in Local File Store Backend Affected: 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0 |
| CVE-2026-23940 | 6.5 | Mar 13 | Denial of Service via Oversized Package Upload Affected: before 2026-03-10; 82911daf5f8fb2ab44f298e3ba22b90bc1ae3746 before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01 |
| CVE-2026-21618 | 6.1 | Jan 19 | Cross-site scripting (XSS) in OAuth Device Authorization screen Affected: 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8 |
| CVE-2026-21621 | 5.3 | Mar 5 | Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access Affected: 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b before 71c127afebb7ed7cc637eb231b98feb802d62999 |
| CVE-2026-86698 | 2.3 | Sep 22 | Refresh tokens accepted as private repository credentials at the CDN Affected: 2025-10-10 before 2026-09-22; 650faa03af511e74c1b3b49ec12d35666b6984c4 before db58cf3a86c7639708ef52ff86de0b4f938e6360 |
| CVE-2026-75554 | 2.3 | Aug 24 | Explicit organization scopes survive token refresh after membership ends Affected: 2025-10-10 before 2026-08-24; 650faa03af511e74c1b3b49ec12d35666b6984c4 before 50cffd206490c49c92d7b63c8505949682abedb0 |
Showing 8