Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1000
Switch view
CWE-1000 at MITRE
Switch view
We're looking at the CWE hierarchy through the Research Concepts view.
Improper Control of a Resource Through its Lifetime CWE-664
102
(53.4%)
Improper Neutralization CWE-707
33
(17.3%)
Improper Access Control CWE-284
21
(11.0%)
Protection Mechanism Failure CWE-693
12
(6.3%)
Improper Interaction Between Multiple Correctly-Behaving Entities CWE-435
7
(3.7%)
Insufficient Control Flow Management CWE-691
7
(3.7%)
Improper Check or Handling of Exceptional Conditions CWE-703
4
(2.1%)
Improper Adherence to Coding Standards CWE-710
3
(1.6%)
Incorrect Calculation CWE-682
1
(0.5%)
Incorrect Comparison CWE-697
1
(0.5%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Filter expression injection via forged keyset pagination cursor in Ash | CVE-2026-67579 | 2026-08-12 | |
| Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR | CVE-2026-64941 | 2026-08-10 | |
| Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash | CVE-2026-70395 | 2026-08-09 | |
| Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset | CVE-2026-69659 | 2026-08-09 | |
| Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation | CVE-2026-67585 | 2026-08-07 | |
| SQL injection via the :comment option in Postgrex.stream/4 | CVE-2026-66838 | 2026-08-07 | |
| Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service | CVE-2026-68750 | 2026-08-06 | |
| Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service | CVE-2026-68749 | 2026-08-06 | |
| CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input | CVE-2026-68747 | 2026-08-06 | |
| html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection | CVE-2026-66829 | 2026-08-06 | |
| html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking | CVE-2026-66370 | 2026-08-06 | |
| html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding | CVE-2026-66843 | 2026-08-06 | |
| Livebook Teams identity callback lacks state binding, allowing login CSRF |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66885 | 2026-08-05 |
| JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66298 | 2026-08-05 |
| Unescaped deployment environment variables in generated setup commands |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66297 | 2026-08-05 |
| Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66881 | 2026-08-05 |
| Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access |
ghcr.io / livebook-dev/livebook
|
CVE-2026-68746 | 2026-08-05 |
| Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup | CVE-2026-66883 | 2026-08-04 | |
| Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection | CVE-2026-66884 | 2026-08-04 | |
| Reflected XSS in oaskit's default HTML error handler | CVE-2026-66296 | 2026-08-03 | |
| guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1 | CVE-2026-55734 | 2026-08-01 | |
| Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation | CVE-2026-55733 | 2026-08-01 | |
| Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys | CVE-2026-54894 | 2026-08-01 | |
| Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation | CVE-2026-55735 | 2026-08-01 | |
| YAML injection via unescaped newlines in ymlr document comments | CVE-2026-65636 | 2026-07-31 |
25 per page ·
171 CVEs