Login Request a demo
HE
Product
hexpm
by hexpm · last CVE Sep 22, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 1High 2Medium 3Low 2
Severity
All severities8Critical1High2Medium3Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hexpm to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-23940
6.5
0%
Mar 13
Denial of Service via Oversized Package Upload
Affected: before 2026-03-10; 82911daf5f8fb2ab44f298e3ba22b90bc1ae3746 before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01
CVE-2026-21618
6.1
0%
Jan 19
Cross-site scripting (XSS) in OAuth Device Authorization screen
Affected: 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8
CVE-2026-21621
5.3
0%
Mar 5
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
Affected: 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b before 71c127afebb7ed7cc637eb231b98feb802d62999
Showing 3