HE
Vendor
hexpm
23
CVEs
0
On KEV
11
New 30D
Products
HE7.5
hex
hexpm
10 CVEs0 on KEV8 new
HE7.5
hex_core
hexpm
4 CVEs0 on KEV3 new
HE9.8
hexpm
hexpm
7 CVEs0 on KEV0 new
HE9.8
hex.pm
hexpm
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96596 | HE hex hexpm | 5.9 | Oct 14 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole |
| CVE-2026-105274 | HE hex_core hexpm | 2.1 | Oct 12 | hex_core decompresses registry and Erlang term API responses without size limits |
| CVE-2026-81856 | HE hex hexpm | 2.3 | Oct 12 | Terminal escape sequence injection in Hex via unneutralized server-supplied output |
| CVE-2026-96612 | HE hex hexpm | 7.5 | Oct 12 | Path traversal in Hex via unvalidated dependency app names |
| CVE-2026-105668 | HE hex hexpm | 7.1 | Oct 12 | Hex release-age cooldown is lifted package-wide when the locked release is retired |
| CVE-2026-105280 | HE hex hexpm | 6.9 | Oct 12 | Hex writes unverified package tarballs to standard output in mix hex.package fetch |
| CVE-2026-96618 | HE hex hexpm | 2.1 | Oct 12 | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror |
| CVE-2026-103503 | HE hex hexpm | 5.9 | Oct 12 | Hex trusts its bundled CA certificates when cacerts_path is set |
| CVE-2026-103502 | HE hex_core hexpm | 5.9 | Oct 12 | hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 |
| CVE-2026-86698 | HE hexpm hexpm | 2.3 | Sep 22 | Refresh tokens accepted as private repository credentials at the CDN |
| CVE-2026-75554 | HE hexpm hexpm | 2.3 | Aug 24 | Explicit organization scopes survive token refresh after membership ends |
| CVE-2026-75542 | HE hexpm hexpm | 8.3 | Aug 24 | OAuth token exchange grants repository scopes for organizations the principal cannot access |
| CVE-2026-32148 | HE hex hexpm | 5.9 | Apr 30 | Lockfile checksums not verified in Hex allows dependency integrity bypass |
| CVE-2026-23940 | HE hexpm hexpm | 6.5 | Mar 13 | Denial of Service via Oversized Package Upload |
| CVE-2026-21622 | HE hex.pm hexpm | 9.8 | Mar 5 | Password Reset Tokens Do Not Expire |
| CVE-2026-21621 | HE hexpm hexpm | 5.3 | Mar 5 | Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access |
| CVE-2026-21619 | HE hex hexpm | 7.5 | Feb 27 | Unsafe Deserialization of Erlang Terms in hex_core |
| CVE-2026-23939 | HE hexpm hexpm | 7.5 | Feb 26 | Path Traversal in Local File Store Backend |