Skip to content
OpenAdvisories

Ecosystem

Hex

355 known vulnerabilities.

Most affected packages

ash 31 bandit 24 ash_authentication 24 hackney 17 mint 14 mpp 13 jose 9 ash_typescript 8 plug 8 cowlib 8 ash_admin 7 ash_ai 7 mdex 6 livebook 6 html_sanitize_ex 6 ash_graphql 6 ash_authentication_oauth2_server 6 hex_core 5 phoenix 5 tesla 5 ash_sql 5 esaml 4 ash_postgres 4 gun 4 grpc 4 mdex_native 4 guardian 4 cowboy 4 ash_phoenix 4 rabbit_common 4 ash_authentication_phoenix 3 postgrex 3 phoenix_storybook 3 xml_builder 3 saxy 3 samly 3 boruta 3 ash_paper_trail 3 ewe 3 beam_mcp 2
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli nodejs dotnet7 Debian Ubuntu Alpine PyPI Go Hex
    KEV Oct 27, 2026
  • High 8.7
    CVE-2026-59248 Public exploit

    Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

    Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder …

    ninenines cowlib rabbitmq-server cowlib Debian Ubuntu Hex
  • Low 2.1
    CVE-2026-58225 Public exploit

    SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

    SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection. Postgrex.Notifications sanitizes channel …

    elixir-ecto postgrex postgrex Hex
  • Low 2.1
    CVE-2026-48598 Public exploit

    CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

    Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via unescaped Content-Disposition parameter values. Tesla.Multipart.part_headers_for_disposition/1 interpolates each disposition parameter as #{…

    elixir-tesla tesla tesla Hex
  • Critical 9.5
    CVE-2026-8467 Public exploit

    Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

    Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.Pl…

    phenixdigital phoenix_storybook phoenix_storybook Hex
  • Medium 4.5
    CVE-2019-11287 Public exploit

    RabbitMQ Web Management Plugin DoS via heap overflow

    Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack…

    Pivotal RabbitMQ RabbitMQ for Pivotal Platform rabbitmq-server Debian Ubuntu Hex