Skip to content
OpenAdvisories

Ecosystem

Hex

356 known vulnerabilities.

Most affected packages

ash 31 bandit 24 ash_authentication 24 hackney 17 mint 14 mpp 13 jose 9 ash_typescript 8 plug 8 cowlib 8 ash_ai 8 ash_admin 7 mdex 6 livebook 6 html_sanitize_ex 6 ash_graphql 6 ash_authentication_oauth2_server 6 hex_core 5 phoenix 5 tesla 5 ash_sql 5 esaml 4 ash_postgres 4 gun 4 grpc 4 mdex_native 4 guardian 4 cowboy 4 ash_phoenix 4 rabbit_common 4 ash_authentication_phoenix 3 postgrex 3 phoenix_storybook 3 xml_builder 3 saxy 3 samly 3 boruta 3 ash_paper_trail 3 ewe 3 beam_mcp 2
All Critical High Medium Low Exploited only Public exploit

129 results · Clear filters · Feed

  • High 7.1
    CVE-2025-48042

    Before action hooks may execute in certain scenarios despite a request being forbidden

    Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from 0.1.1 before 3.5.39.

    ash-project ash ash Hex
  • High 8.8
    CVE-2023-45312

    MTProto proxy remote code execution vulnerability

    In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability.

    mtproto_proxy Hex
  • High 8.6
    CVE-2023-35174

    Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

    Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user usi…

    livebook-dev livebook livebook Hex
  • High 7.5
    CVE-2022-42975

    Phoenix before 1.6.14 mishandles check_origin wildcarding

    socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.

    phoenix Hex
  • High 7.5
    CVE-2019-15160

    Inline DTD allows XML bomb attack

    The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.

    sweet_xml Hex
  • High 8.8
    CVE-2019-1000013

    Hex authenticity of signed packages not validated

    Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fe…

    hex_core Hex
  • High 8.1
    CVE-2017-1000053

    Arbitrary Code Execution in Cookie Serialization

    Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

    plug Hex
  • High 7.8
    CVE-2017-1000052

    Null Byte Injection in Plug.Static

    Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

    plug Hex
  • High —
    CVE-2014-2829

    Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream

    Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

    MongooseIM Hex