hexpm

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

hexpm records in CISA KEV

No hexpm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Hexpm 5 records MEDIUM Hex 3 records HIGH Hex Core 2 records MEDIUM

Records

3 records in Hex · all components

TI-2026-24685 CVE-2026-32148

Lockfile checksums not verified in Hex allows dependency integrity bypass

HIGH 74

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.

CVSS 4.0HIGH 8.9 Network No auth User interaction EPSS 0.00192 Published 2026-04-30 Fixed in 2.4.2 CWE-354

TI-2019-15829 CVE-2019-1000012 · GHSA-rhxf-5pw9-q4gm

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability…

MEDIUM 40

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00877 Published 2019-02-04 No fix listed CWE-345

TI-2026-17411 CVE-2026-21619 · GHSA-hx9w-f2w9-9g96

Unsafe Deserialization of Erlang Terms in hex_core

LOW 12

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessi…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00638 Published 2026-02-27 Fixed in 0.12.1, 2.3.2 +1 CWE-400

Open these records in search →

Critical	1
High	9
Medium	5
Low	6
No CVSS	0