hex
Security Advisories in hex
Medium
4 days ago
AshLua eval read operations can read field-policy-protected fields via aggregates
hex
ash_lua
Low
5 days ago
Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
hex
usage_rules
Low
5 days ago
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
hex
igniter
High
5 days ago
AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
hex
ash_lua
Low
5 days ago
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
hex
ash_double_entry
Medium
5 days ago
ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
hex
ash_authentication_oauth2_server
Medium
5 days ago
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
hex
ash_authentication_oauth2_server
Medium
5 days ago
ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
hex
ash_authentication_oauth2_server
Medium
5 days ago
ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
hex
ash_authentication_oauth2_server
Medium
5 days ago
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
hex
ash_authentication_oauth2_server
High
5 days ago
Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
hex
ash_authentication_oauth2_server
Medium
7 days ago
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
hex
ash
High
8 days ago
Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
hex
mint
Medium
8 days ago
Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
hex
mint
High
9 days ago
Phoenix: Unbounded channel joins per transport enables DoS over few connections
hex
phoenix
Moderate
9 days ago
Phoenix: Presence keys colliding with `Object.prototype` members break existence checks
npm, hex
phoenix
Medium
12 days ago
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
hex
ash
Low
12 days ago
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
hex
ash
Medium
12 days ago
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
hex
ash
Low
12 days ago
Ash.Reactor change step fails open, skipping a change when its where guard raises
hex
ash
Low
12 days ago
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
hex
ash
Medium
12 days ago
Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
hex
ash
Low
12 days ago
Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
hex
ash
Low
12 days ago
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
hex
ash
Medium
12 days ago
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
hex
ash
Medium
12 days ago
Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
hex
ash
Low
12 days ago
Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
hex
ash
Low
12 days ago
Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
hex
ash_typescript
High
12 days ago
Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
hex
ash_typescript
Medium
12 days ago
Route handler return value echoed into AshTypescript error response
hex
ash_typescript
Medium
12 days ago
Declared argument constraints not enforced on AshTypescript typed controller routes
hex
ash_typescript
High
12 days ago
Authorization-redacted field values disclosed through AshTypescript result normalization
hex
ash_typescript
Medium
12 days ago
RPC error handler fails open in AshTypescript, disclosing unredacted errors
hex
ash_typescript
High
12 days ago
Unbounded atom creation from typed struct field names in AshTypescript field selector
hex
ash_typescript
Low
13 days ago
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
hex
ash_phoenix
High
13 days ago
Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
hex
ash_phoenix
Medium
13 days ago
AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
hex
ash_phoenix
Low
13 days ago
AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
hex
ash_phoenix
High
13 days ago
Path traversal in AshAdmin file uploads via unsanitized client filename
hex
ash_admin
Low
13 days ago
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
hex
ash_admin
Low
13 days ago
Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
hex
ash_admin
High
13 days ago
Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
hex
ash_admin
High
13 days ago
AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
hex
ash_admin
High
13 days ago
AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
hex
ash_admin
High
13 days ago
AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
hex
ash_ai
Medium
13 days ago
AshAi echoes raw tool exception messages into the conversation, disclosing internal details
hex
ash_ai
Medium
13 days ago
AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service
hex
ash_ai
High
13 days ago
Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records
hex
ash_ai
High
13 days ago
MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header
hex
ash_ai
High
13 days ago
EEx template evaluation of prompt content in AshAi enables remote code execution
hex
ash_ai
Medium
13 days ago
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
hex
ash_graphql
High
13 days ago
Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
hex
ash_graphql
High
13 days ago
Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
hex
ash_graphql
Medium
13 days ago
Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
hex
ash_graphql
Low
13 days ago
Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
hex
ash_graphql
Low
13 days ago
Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
hex
ash_graphql
Low
13 days ago
Cloaked plaintext leaks through a non-sensitive action argument in AshCloak
hex
ash_cloak
Medium
13 days ago
Unsafe deserialization of decrypted terms enables node DoS in AshCloak
hex
ash_cloak
High
13 days ago
rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
hex
ash_postgres
Medium
14 days ago
exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql
hex
ash_sql
Low
14 days ago
Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
hex
ash_sql
Low
14 days ago
Unescaped backslash allows LIKE wildcard injection in AshSql string search
hex
ash_sql
Low
14 days ago
SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
hex
ash_sql
Medium
14 days ago
Unbounded handle_error recursion enables denial of service in AshOban triggers
hex
ash_oban
Medium
14 days ago
Job argument injection via :args overrides primary_key and tenant in AshOban
hex
ash_oban
High
14 days ago
Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc
hex
oidcc
Low
14 days ago
Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
hex
ash_paper_trail
Medium
14 days ago
Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
hex
ash_paper_trail
Medium
14 days ago
Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
hex
ash_paper_trail
Medium
16 days ago
Doggo vulnerable to cross-site scripting via unescaped date field values
hex
doggo
Critical
18 days ago
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching
hex
ash_authentication
High
18 days ago
gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`
hex
grpc
High
18 days ago
gRPC Erlang package's path bindings are overridable by query string and request body
hex
grpc
Critical
18 days ago
gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads
hex
grpc
High
19 days ago
Purpose-limited JWT accepted as full bearer authentication in AshAuthentication
hex
ash_authentication
Low
19 days ago
Reflected XSS in AshAuthentication confirmation and magic link interaction forms
hex
ash_authentication
Low
23 days ago
Element and Attribute Names Injected Verbatim into XML Output in xml_builder
hex
xml_builder
Medium
23 days ago
HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit
hex
bandit
High
23 days ago
HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit
hex
bandit
Critical
23 days ago
Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
hex
samly
High
23 days ago
Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
hex
samly
High
24 days ago
On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay
hex
mpp
Medium
24 days ago
Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
hex
mpp
Moderate
25 days ago
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion
hex
membrane_mp4_plugin
Filter by Severity
Filter by Package
ash
28
hackney
22
bandit
17
mint
14
cowlib
11
tesla
10
mpp
9
phoenix
8
grpc
8
plug
8
ash_ai
7
ash_typescript
7
ash_admin
7
gun
7
livebook
6
phoenix_storybook
6
ash_graphql
6
ash_authentication
6
mdex
6
ash_authentication_oauth2_server
6
html_sanitize_ex
6
ash_sql
5
absinthe
4
ash_phoenix
4
rabbit_common
4
cowboy
4
wisp
4
postgrex
4
guardian
4
mdex_native
4
req
4
oban_web
4
hex_core
3
xml_builder
3
ewe
3
ash_paper_trail
3
boruta
3
pow
2
ash_postgres
2
ash_lua
2
samly
2
phoenix_live_view
2
plug_cowboy
2
oidcc_plug
2
oidcc
2
earmark
2
ex_aws_sns
2
phoenix
2
ash_authentication_phoenix
2
decimal
2
absinthe_plug
2
ash_oban
2
ash_cloak
2
phoenix_html
2
membrane_mp4_plugin
2
ex_webrtc
1
mtproto_proxy
1
xain
1
sweet_xml
1
github.com/altcha-org/altcha-lib-go
1
ash_sqlite
1
hpax
1
ymlr
1
absinthe_federation
1
ecto
1
altcha
1
altcha
1
pow_assent
1
paginator
1
protobuf
1
altcha-org/altcha
1
usage_rules
1
phoenix_html
1
RabbitMQ
1
ash_double_entry
1
jose
1
altcha
1
alchemist.vim
1
quic
1
oaskit
1
esaml
1
ueberauth_apple
1
Samly
1
ejabberd
1
doggo
1
nodejs
1
puppetlabs-rabbitmq
1
pleroma
1
ecdsa-elixir
1
altcha-lib
1
MongooseIM
1
org.altcha:altcha
1
coherence
1
igniter
1
relyra
1
swoosh
1
Filter by Repository
https://github.com/ash-project/ash
27
https://github.com/benoitc/hackney
12
https://github.com/mtrudel/bandit
10
https://github.com/elixir-mint/mint
10
https://github.com/ZenHive/mpp
9
https://github.com/ash-project/ash_admin
7
https://github.com/ash-project/ash_ai
7
https://github.com/ash-project/ash_typescript
7
https://github.com/livebook-dev/livebook
6
https://github.com/ash-project/ash_authentication_oauth2_server
6
https://github.com/ash-project/ash_graphql
6
https://github.com/rrrene/html_sanitize_ex
6
https://github.com/elixir-tesla/tesla
5
https://github.com/team-alembic/ash_authentication
5
https://github.com/elixir-plug/plug
5
https://github.com/ninenines/cowlib
5
https://github.com/ash-project/ash_sql
5
https://github.com/phoenixframework/phoenix
4
https://github.com/elixir-grpc/grpc
4
https://github.com/leandrocp/mdex_native
4
https://github.com/elixir-ecto/ecto
4
https://github.com/ash-project/ash_phoenix
4
https://github.com/ueberauth/guardian
4
https://github.com/phenixdigital/phoenix_storybook
3
https://github.com/ninenines/gun
3
https://github.com/ash-project/ash_paper_trail
3
https://github.com/ninenines/cowboy
3
https://github.com/malach-it/boruta_auth
3
https://github.com/joshnuss/xml_builder
3
https://github.com/erlef/oidcc
2
https://github.com/erlef/oidcc_plug
2
https://github.com/gleam-wisp/wisp
2
https://github.com/hexpm/hex_core
2
https://github.com/ash-project/ash_postgres
2
https://github.com/ash-project/ash_oban
2
https://github.com/ash-project/ash_lua
2
https://github.com/ash-project/ash_cloak
2
https://github.com/phoenixframework/phoenix_live_view
2
https://github.com/phoenixframework/phoenix_html
2
https://github.com/oban-bg/oban_web
2
https://github.com/team-alembic/ash_authentication_phoenix
2
https://github.com/leandrocp/mdex
2
https://github.com/absinthe-graphql/absinthe
2
https://github.com/wojtekmach/req
2
https://github.com/ash-project/igniter
1
https://github.com/pow-auth/pow
1
https://github.com/ash-project/ash_sqlite
1
https://github.com/pow-auth/pow_assent
1
https://github.com/processone/ejabberd
1
https://github.com/rabbitmq/rabbitmq-server
1
https://github.com/smpallen99/coherence
1
https://github.com/woylie/doggo
1
https://github.com/smpallen99/xain
1
https://github.com/starkbank/ecdsa-elixir
1
https://github.com/absinthe-graphql/absinthe_plug
1
https://github.com/swoosh/swoosh
1
https://github.com/ash-project/ash_double_entry
1
https://github.com/tonini/alchemist-server
1
https://github.com/ueberauth/ueberauth_apple
1
https://github.com/kbrw/sweet_xml
1
https://github.com/ex-aws/ex_aws_sns
1
https://github.com/esl/MongooseIM
1
https://github.com/kphrx/pleroma
1
https://github.com/erlef/cowlib
1
https://github.com/ericmj/decimal
1
https://github.com/lud/oaskit
1
https://github.com/elixir-plug/plug_cowboy
1
https://github.com/membraneframework/membrane_mp4_plugin
1
https://github.com/elixir-mint/hpax
1
https://github.com/P3ngu1nW/CVE_Request
1
https://github.com/duffelhq/paginator
1
https://github.com/DrunkenShells/Disclosures
1
https://github.com/dropbox/samly
1
https://github.com/DivvyPayHQ/absinthe_federation
1
https://github.com/danschultzer/pow
1
https://github.com/ash-project/usage_rules
1
https://github.com/ufirstgroup/ymlr
1