Read the docs

hexpm

Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

hexpm records in CISA KEV

No hexpm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Hexpm 5 records MEDIUM Hex 3 records HIGH Hex Core 2 records MEDIUM

Records

5 records in Hexpm · all components

TI-2026-17414 CVE-2026-21622

Password Reset Tokens Do Not Expire

Priority MEDIUM 49

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00444 Published 2026-03-05 Fixed in 2026-03-05 CWE-613
TI-2026-17410 CVE-2026-21618

Cross-site scripting (XSS) in OAuth Device Authorization screen

Priority MEDIUM 44

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS).

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00261 Published 2026-01-19 Fixed in 2026-01-19 CWE-79
TI-2026-19283 CVE-2026-23940

Denial of Service via Oversized Package Upload

Priority LOW 38

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00467 Published 2026-03-13 Fixed in 2026-03-10 CWE-400
TI-2026-19282 CVE-2026-23939

Path Traversal in Local File Store Backend

Priority LOW 37

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00475 Published 2026-02-26 Fixed CWE-22
Open these records in search →