Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: hexpm Component: Hexpm Clear all filters
TI-2026-19283 CVE-2026-23940

Denial of Service via Oversized Package Upload

Priority LOW 38

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00467 Published 2026-03-13 Fixed in 2026-03-10 CWE-400
TI-2026-17414 CVE-2026-21622

Password Reset Tokens Do Not Expire

Priority MEDIUM 49

Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00444 Published 2026-03-05 Fixed in 2026-03-05 CWE-613
TI-2026-19282 CVE-2026-23939

Path Traversal in Local File Store Backend

Priority LOW 37

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00475 Published 2026-02-26 Fixed CWE-22
TI-2026-17410 CVE-2026-21618

Cross-site scripting (XSS) in OAuth Device Authorization screen

Priority MEDIUM 44

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS).

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00261 Published 2026-01-19 Fixed in 2026-01-19 CWE-79