Read the docs

hexpm

Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

hexpm records in CISA KEV

No hexpm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Hexpm 5 records MEDIUM Hex 3 records HIGH Hex Core 2 records MEDIUM

Records

2 records in Hex Core · all components

TI-2019-15830 CVE-2019-1000013 · GHSA-q3cc-rr2c-87r6

Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle…

Priority MEDIUM 40

Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00877 Published 2019-02-04 Fixed in 0.4.0 CWE-345
TI-2026-17411 CVE-2026-21619 · GHSA-hx9w-f2w9-9g96

Unsafe Deserialization of Erlang Terms in hex_core

Priority LOW 12

Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessi…

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00638 Published 2026-02-27 Fixed in 0.12.1, 2.3.2 +1 CWE-400
Open these records in search →