HE
Vendor
Hex
10
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-32148 | HE Hex Hex | 5.9 | Apr 30 | Lockfile checksums not verified in Hex allows dependency integrity bypass |
| CVE-2026-23940 | HE Hexpm Hex | 6.5 | Mar 13 | Denial of Service via Oversized Package Upload |
| CVE-2026-21622 | HE Hexpm Hex | 9.8 | Mar 5 | Password Reset Tokens Do Not Expire |
| CVE-2026-21621 | HE Hexpm Hex | 5.3 | Mar 5 | Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access |
| CVE-2026-21619 | HE Hex Hex | 7.5 | Feb 27 | Unsafe Deserialization of Erlang Terms in hex_core |
| CVE-2026-23939 | HE Hexpm Hex | 7.5 | Feb 26 | Path Traversal in Local File Store Backend |
| CVE-2026-21618 | HE Hexpm Hex | 6.1 | Jan 19 | Cross-site scripting (XSS) in OAuth Device Authorization screen |
| CVE-2019-1000012 | HE Hex Hex | 8.8 | Feb 4 | Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected,… |
| CVE-2019-1000013 | HC Hex Core Hex | 8.8 | Feb 4 | Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not… |