Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Protection Mechanism Failure CWE-693 CWE-693 at MITRE
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Insufficient Verification of Data Authenticity CWE-345
18
(51.4%)
Inadequate Encryption Strength CWE-326
3
(8.6%)
Use of a Broken or Risky Cryptographic Algorithm CWE-327
3
(8.6%)
Missing Encryption of Sensitive Data CWE-311
2
(5.7%)
Use of Insufficiently Random Values CWE-330
2
(5.7%)
Improper Protection of Alternate Path CWE-424
2
(5.7%)
Client-Side Enforcement of Server-Side Security CWE-602
2
(5.7%)
Improper Isolation or Compartmentalization CWE-653
1
(2.9%)
Selection of Less-Secure Algorithm During Negotiation CWE-757
1
(2.9%)
Reliance on Untrusted Inputs in a Security Decision CWE-807
1
(2.9%)
Incomplete List of Disallowed Inputs CWE-184
0
(0.0%)
Insufficient UI Warning of Dangerous Operations CWE-357
0
(0.0%)
Improperly Implemented Security Check for Standard CWE-358
0
(0.0%)
Reliance on a Single Factor in a Security Decision CWE-654
0
(0.0%)
Insufficient Psychological Acceptability CWE-655
0
(0.0%)
Reliance on Security Through Obscurity CWE-656
0
(0.0%)
Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism CWE-1039
0
(0.0%)
Semiconductor Defects in Hardware Logic with Security-Sensitive Implications CWE-1248
0
(0.0%)
Incorrect Selection of Fuse Values CWE-1253
0
(0.0%)
Product Released in Non-Release Configuration CWE-1269
0
(0.0%)
Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques CWE-1278
0
(0.0%)
Public Key Re-Use for Signing both Debug and Production Code CWE-1291
0
(0.0%)
Missing Support for Security Features in On-chip Fabrics or Buses CWE-1318
0
(0.0%)
Improper Protection against Electromagnetic Fault Injection (EM-FI) CWE-1319
0
(0.0%)
Missing Immutable Root of Trust in Hardware CWE-1326
0
(0.0%)
CVEs
CVEs for Protection Mechanism Failure CWE-693
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Unverified Sign in with Apple callback parameter can override verified ID token claims | CVE-2026-117656 | 2026-10-30 | |
| ECDSA signature length is not validated in jose, allowing signature malleability | CVE-2026-65632 | 2026-10-26 | |
| Weak PBKDF2 parameters for password-encrypted private-key export in jose | CVE-2026-65629 | 2026-10-26 | |
| Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose | CVE-2026-65625 | 2026-10-26 | |
| WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit | CVE-2026-110314 | 2026-10-26 | |
| Hex release-age cooldown is lifted package-wide when the locked release is retired |
Hex Mix Integration
|
CVE-2026-105668 | 2026-10-12 |
| Hex writes unverified package tarballs to standard output in mix hex.package fetch |
Hex Mix Integration
|
CVE-2026-105280 | 2026-10-12 |
| Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds | CVE-2026-94206 | 2026-10-06 | |
| Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping | CVE-2026-95105 | 2026-10-06 | |
| Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy | CVE-2026-91187 | 2026-09-24 | |
| Token revocation record built from unverified JWT claims in AshAuthentication | CVE-2026-78223 | 2026-09-17 | |
| Reversible IP address pseudonymisation in AshAuthentication audit log hash mode | CVE-2026-82759 | 2026-09-17 | |
| AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes | CVE-2026-82586 | 2026-09-07 | |
| ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | CVE-2026-82754 | 2026-09-07 | |
| AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | CVE-2026-81852 | 2026-08-31 | |
| AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain | CVE-2026-75757 | 2026-08-31 | |
| MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header | CVE-2026-81315 | 2026-08-31 | |
| Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc | CVE-2026-75759 | 2026-08-30 | |
| Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions | CVE-2026-77970 | 2026-08-30 | |
| Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail | CVE-2026-75847 | 2026-08-30 | |
| Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses | CVE-2026-53425 | 2026-08-20 | |
| Livebook Teams identity callback lacks state binding, allowing login CSRF |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66885 | 2026-08-05 |
| JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66298 | 2026-08-05 |
| Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection | CVE-2026-66884 | 2026-08-04 | |
| Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation | CVE-2026-55735 | 2026-08-01 |
25 per page ·
33 CVEs