EEF

Latest CVEs · RSS

• CVE-2026-105660 2026-10-15 · CVSS 6.9
  Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port t
• CVE-2026-96596 2026-10-14 · CVSS 5.9
  Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_
• CVE-2026-105236 2026-10-14 · CVSS 6.3
  Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to a
• CVE-2026-94200 2026-10-14 · CVSS 8.2
  Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a
• CVE-2026-105659 2026-10-14 · CVSS 8.7
  Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a tr
• CVE-2026-103061 2026-10-12 · CVSS 5.9
  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete
• CVE-2026-105274 2026-10-12 · CVSS 2.1
  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering he
• CVE-2026-81856 2026-10-12 · CVSS 2.3
  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to
• CVE-2026-103060 2026-10-12 · CVSS 7.5
  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a d
• CVE-2026-96612 2026-10-12 · CVSS 7.5
  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a direc
• CVE-2026-105668 2026-10-12 · CVSS 7.1
  Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly pub
• CVE-2026-105280 2026-10-12 · CVSS 6.9
  Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VER
• CVE-2026-96618 2026-10-12 · CVSS 2.1
  Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk spa
• CVE-2026-103503 2026-10-12 · CVSS 5.9
  Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued
• CVE-2026-103502 2026-10-12 · CVSS 5.9
  Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any
• CVE-2026-105283 2026-10-12 · CVSS 6.3
  Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Eli
• CVE-2026-97853 2026-10-10 · CVSS 6.9
  Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested
• CVE-2026-104635 2026-10-09 · CVSS 8.2
  Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process
• CVE-2026-101028 2026-10-09 · CVSS 6.0
  Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash
• CVE-2026-104634 2026-10-08 · CVSS 2.3
  Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to r
• CVE-2026-88257 2026-10-08 · CVSS 5.3
  Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that
• CVE-2026-94206 2026-10-06 · CVSS 6.3
  Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds t
• CVE-2026-95105 2026-10-06 · CVSS 8.2
  Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with writ
• CVE-2026-94201 2026-10-05 · CVSS 8.2
  Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced thr
• CVE-2026-94194 2026-09-28 · CVSS 6.3
  Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchro