Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1000
Switch view
CWE-1000 at MITRE
Switch view
We're looking at the CWE hierarchy through the Research Concepts view.
Improper Control of a Resource Through its Lifetime CWE-664
106
(51.0%)
Improper Neutralization CWE-707
39
(18.8%)
Improper Access Control CWE-284
26
(12.5%)
Protection Mechanism Failure CWE-693
13
(6.3%)
Insufficient Control Flow Management CWE-691
8
(3.8%)
Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435
7
(3.4%)
Improper Check or Handling of Exceptional Conditions CWE-703
4
(1.9%)
Improper Adherence to Coding Standards CWE-710
3
(1.4%)
Incorrect Calculation CWE-682
1
(0.5%)
Incorrect Comparison CWE-697
1
(0.5%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Purpose-limited JWT accepted as full bearer authentication in AshAuthentication | CVE-2026-65633 | 2026-08-25 | |
| Reflected XSS in AshAuthentication confirmation and magic link interaction forms | CVE-2026-66882 | 2026-08-25 | |
| Explicit organization scopes survive token refresh after membership ends | CVE-2026-75554 | 2026-08-24 | |
| OAuth token exchange grants repository scopes for organizations the principal cannot access | CVE-2026-75542 | 2026-08-24 | |
| Round-trip Corruption via Improper Entity Escaping in xml_builder | CVE-2026-47079 | 2026-08-21 | |
| Element and Attribute Names Injected Verbatim into XML Output in xml_builder | CVE-2026-48590 | 2026-08-21 | |
| CDATA Section Breakout via Unsanitised ]]> in xml_builder | CVE-2026-47080 | 2026-08-21 | |
| HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit | CVE-2026-75484 | 2026-08-20 | |
| HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit | CVE-2026-74836 | 2026-08-20 | |
| Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions | CVE-2026-53424 | 2026-08-20 | |
| Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses | CVE-2026-53425 | 2026-08-20 | |
| On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay | CVE-2026-67581 | 2026-08-19 | |
| Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain | CVE-2026-73541 | 2026-08-19 | |
| Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay | CVE-2026-73136 | 2026-08-19 | |
| Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race | CVE-2026-73829 | 2026-08-19 | |
| Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1 | CVE-2026-43971 | 2026-08-18 | |
| Filter expression injection via forged keyset pagination cursor in Ash | CVE-2026-67579 | 2026-08-12 | |
| Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR | CVE-2026-64941 | 2026-08-10 | |
| Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash | CVE-2026-70395 | 2026-08-09 | |
| Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset | CVE-2026-69659 | 2026-08-09 | |
| Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation | CVE-2026-67585 | 2026-08-07 | |
| SQL injection via the :comment option in Postgrex.stream/4 | CVE-2026-66838 | 2026-08-07 | |
| Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service | CVE-2026-68750 | 2026-08-06 | |
| Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service | CVE-2026-68749 | 2026-08-06 | |
| CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input | CVE-2026-68747 | 2026-08-06 |
25 per page ·
187 CVEs