EL
Vendor
elixir-plug
6
CVEs
0
On KEV
2
New 30D
Products
PL8.7
plug
elixir-plug
4 CVEs0 on KEV1 new
PL5.1
plug_crypto
elixir-plug
1 CVEs0 on KEV1 new
PL7.5
plug_cowboy
elixir-plug
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105963 New | PL plug_crypto elixir-plug | 5.1 | Oct 23 | Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments |
| CVE-2026-56813 | PL plug elixir-plug | 2.1 | Jul 10 | Cookie attribute injection in Plug.Conn.Cookies.encode/2 |
| CVE-2026-56814 | PL plug elixir-plug | 6.9 | Jul 10 | Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) |
| CVE-2026-54892 | PL plug elixir-plug | 8.7 | Jun 23 | Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
| CVE-2026-32688 | PL plug_cowboy elixir-plug | 7.5 | Apr 27 | Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy |