Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Improper Access Control CWE-284 CWE-284 at MITRE
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Improper Authorization CWE-285
34
(47.2%)
Improper Authentication CWE-287
29
(40.3%)
Origin Validation Error CWE-346
3
(4.2%)
Insufficient Granularity of Access Control CWE-1220
3
(4.2%)
Improper Restriction of Communication Channel to Intended Endpoints CWE-923
2
(2.8%)
Improper Session Management CWE-1462
1
(1.4%)
Improper Privilege Management CWE-269
0
(0.0%)
Improper Ownership Management CWE-282
0
(0.0%)
Incorrect User Management CWE-286
0
(0.0%)
Exposed Dangerous Method or Function CWE-749
0
(0.0%)
On-Chip Debug and Test Interface With Improper Access Control CWE-1191
0
(0.0%)
Improper Restriction of Write-Once Bit Fields CWE-1224
0
(0.0%)
Improper Prevention of Lock Bit Modification CWE-1231
0
(0.0%)
Security-Sensitive Hardware Controls with Missing Lock Bit Protection CWE-1233
0
(0.0%)
CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations CWE-1252
0
(0.0%)
Improper Access Control Applied to Mirrored or Aliased Memory Regions CWE-1257
0
(0.0%)
Improper Handling of Overlap Between Protected Memory Ranges CWE-1260
0
(0.0%)
Improper Access Control for Register Interface CWE-1262
0
(0.0%)
Improper Physical Access Control CWE-1263
0
(0.0%)
Policy Uses Obsolete Encoding CWE-1267
0
(0.0%)
Improper Access Control for Volatile Memory Containing Boot Code CWE-1274
0
(0.0%)
Hardware Child Block Incorrectly Connected to Parent System CWE-1276
0
(0.0%)
Access Control Check Implemented After Asset is Accessed CWE-1280
0
(0.0%)
Mutable Attestation or Measurement Reporting Data CWE-1283
0
(0.0%)
Insecure Security Identifier Mechanism CWE-1294
0
(0.0%)
Incorrect Chaining or Granularity of Debug Components CWE-1296
0
(0.0%)
Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation CWE-1304
0
(0.0%)
Improper Translation of Security Attributes by Fabric Bridge CWE-1311
0
(0.0%)
Missing Protection for Mirrored Regions in On-Chip Fabric Firewall CWE-1312
0
(0.0%)
Hardware Allows Activation of Test or Debug Logic at Runtime CWE-1313
0
(0.0%)
Improper Setting of Bus Controlling Capability in Fabric End-point CWE-1315
0
(0.0%)
Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges CWE-1316
0
(0.0%)
Improper Access Control in Fabric Bridge CWE-1317
0
(0.0%)
Improper Protection for Outbound Error Messages and Alert Signals CWE-1320
0
(0.0%)
Improper Management of Sensitive Trace Data CWE-1323
0
(0.0%)
Unauthorized Error Injection Can Degrade Hardware Redundancy CWE-1334
0
(0.0%)
Improper Check for Credential Expiration CWE-1469
0
(0.0%)
Generation of Credential with Long Expiration CWE-1472
0
(0.0%)
CVEs
CVEs for Improper Access Control CWE-284
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Unverified Sign in with Apple callback parameter can override verified ID token claims | CVE-2026-117656 | 2026-10-30 | |
| ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary | CVE-2026-117666 | 2026-10-30 | |
| Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CVE-2026-115693 | 2026-10-26 | |
| HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney | CVE-2026-113440 | 2026-10-26 | |
| An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records | CVE-2026-96581 | 2026-10-26 | |
| AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | CVE-2026-115627 | 2026-10-25 | |
| AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | CVE-2026-115635 | 2026-10-25 | |
| Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records | CVE-2026-114214 | 2026-10-25 | |
| WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers | CVE-2026-107685 | 2026-10-23 | |
| TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries |
Erlang
Erlang / ssl
|
CVE-2026-105236 | 2026-10-14 |
| Hex trusts its bundled CA certificates when cacerts_path is set |
Hex Mix Integration
|
CVE-2026-103503 | 2026-10-12 |
| hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 | CVE-2026-103502 | 2026-10-12 | |
| Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts | CVE-2026-101028 | 2026-10-09 | |
| mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed | CVE-2026-87119 | 2026-09-22 | |
| TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension |
Erlang
Erlang / ssl
|
CVE-2026-89422 | 2026-09-22 |
| Session id is not renewed on authentication in ash_authentication, allowing session fixation | CVE-2026-86688 | 2026-09-17 | |
| Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement | CVE-2026-76949 | 2026-09-17 | |
| dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover | CVE-2026-91039 | 2026-09-17 | |
| OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | CVE-2026-88952 | 2026-09-17 | |
| `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication | CVE-2026-85500 | 2026-09-17 | |
| Sign-in token minted for one resource accepted by another in AshAuthentication | CVE-2026-80218 | 2026-09-17 | |
| Confirmation token accepted on any record in AshAuthentication | CVE-2026-82685 | 2026-09-17 | |
| Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle | CVE-2026-86338 | 2026-09-16 | |
| AshLua eval read operations can read field-policy-protected fields via aggregates | CVE-2026-78216 | 2026-09-08 | |
| AshAi aggregate tool can read field-policy-protected fields | CVE-2026-78230 | 2026-09-08 |
25 per page ·
71 CVEs