Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-1003
Switch view
CWE-1003 at MITRE

We're looking at the CWE hierarchy through the Weaknesses for Simplified Mapping of Published Vulnerabilities view.

Uncontrolled Resource Consumption: 47 CVEs (32.2%) — click to drill down Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): 13 CVEs (8.9%) — click to drill down Use of Incorrectly-Resolved Name or Reference: 11 CVEs (7.5%) — click to drill down Externally Controlled Reference to a Resource in Another Sphere: 9 CVEs (6.2%) — click to drill down Improper Authentication: 8 CVEs (5.5%) — click to drill down Insufficient Verification of Data Authenticity: 8 CVEs (5.5%) — click to drill down Incorrect Authorization: 8 CVEs (5.5%) — click to drill down Inefficient Algorithmic Complexity: 6 CVEs (4.1%) — click to drill down Improper Input Validation: 5 CVEs (3.4%) — click to drill down Interpretation Conflict: 5 CVEs (3.4%) — click to drill down Improper Control of Dynamically-Managed Code Resources: 4 CVEs (2.7%) — click to drill down Operation on a Resource after Expiration or Release: 3 CVEs (2.1%) — click to drill down Excessive Iteration: 3 CVEs (2.1%) — click to drill down Improper Encoding or Escaping of Output: 2 CVEs (1.4%) — click to drill down Improper Restriction of Operations within the Bounds of a Memory Buffer: 2 CVEs (1.4%) — click to drill down Incorrect Resource Transfer Between Spheres: 2 CVEs (1.4%) — click to drill down Uncontrolled Recursion: 2 CVEs (1.4%) — click to drill down Exposure of Sensitive Information to an Unauthorized Actor: 1 CVEs (0.7%) — click to drill down Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'): 1 CVEs (0.7%) — click to drill down Improper Resource Shutdown or Release: 1 CVEs (0.7%) — click to drill down Exposure of Resource to Wrong Sphere: 1 CVEs (0.7%) — click to drill down Incorrect Calculation: 1 CVEs (0.7%) — click to drill down Improper Check for Unusual or Exceptional Conditions: 1 CVEs (0.7%) — click to drill down Improper Handling of Exceptional Conditions: 1 CVEs (0.7%) — click to drill down Missing Authorization: 1 CVEs (0.7%) — click to drill down Improper Privilege Management: 0 CVEs (0.0%) — click to drill down Missing Encryption of Sensitive Data: 0 CVEs (0.0%) — click to drill down Inadequate Encryption Strength: 0 CVEs (0.0%) — click to drill down Use of a Broken or Risky Cryptographic Algorithm: 0 CVEs (0.0%) — click to drill down Use of Insufficiently Random Values: 0 CVEs (0.0%) — click to drill down Improper Synchronization: 0 CVEs (0.0%) — click to drill down Improper Initialization: 0 CVEs (0.0%) — click to drill down Always-Incorrect Control Flow Implementation: 0 CVEs (0.0%) — click to drill down Incorrect Comparison: 0 CVEs (0.0%) — click to drill down Incorrect Type Conversion or Cast: 0 CVEs (0.0%) — click to drill down Incorrect Permission Assignment for Critical Resource: 0 CVEs (0.0%) — click to drill down Insecure Storage of Sensitive Information: 0 CVEs (0.0%) — click to drill down Total 137
Uncontrolled Resource Consumption CWE-400 47 (32.2%) Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74 13 (8.9%) Use of Incorrectly-Resolved Name or Reference CWE-706 11 (7.5%) Externally Controlled Reference to a Resource in Another Sphere CWE-610 9 (6.2%) Improper Authentication CWE-287 8 (5.5%) Insufficient Verification of Data Authenticity CWE-345 8 (5.5%) Incorrect Authorization CWE-863 8 (5.5%) Inefficient Algorithmic Complexity CWE-407 6 (4.1%) Improper Input Validation CWE-20 5 (3.4%) Interpretation Conflict CWE-436 5 (3.4%) Improper Control of Dynamically-Managed Code Resources CWE-913 4 (2.7%) Operation on a Resource after Expiration or Release CWE-672 3 (2.1%) Excessive Iteration CWE-834 3 (2.1%) Improper Encoding or Escaping of Output CWE-116 2 (1.4%) Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 2 (1.4%) Incorrect Resource Transfer Between Spheres CWE-669 2 (1.4%) Uncontrolled Recursion CWE-674 2 (1.4%) Exposure of Sensitive Information to an Unauthorized Actor CWE-200 1 (0.7%) Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-362 1 (0.7%) Improper Resource Shutdown or Release CWE-404 1 (0.7%) Exposure of Resource to Wrong Sphere CWE-668 1 (0.7%) Incorrect Calculation CWE-682 1 (0.7%) Improper Check for Unusual or Exceptional Conditions CWE-754 1 (0.7%) Improper Handling of Exceptional Conditions CWE-755 1 (0.7%) Missing Authorization CWE-862 1 (0.7%) Improper Privilege Management CWE-269 0 (0.0%) Missing Encryption of Sensitive Data CWE-311 0 (0.0%) Inadequate Encryption Strength CWE-326 0 (0.0%) Use of a Broken or Risky Cryptographic Algorithm CWE-327 0 (0.0%) Use of Insufficiently Random Values CWE-330 0 (0.0%) Improper Synchronization CWE-662 0 (0.0%) Improper Initialization CWE-665 0 (0.0%) Always-Incorrect Control Flow Implementation CWE-670 0 (0.0%) Incorrect Comparison CWE-697 0 (0.0%) Incorrect Type Conversion or Cast CWE-704 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Insecure Storage of Sensitive Information CWE-922 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Filter expression injection via forged keyset pagination cursor in Ash
Hex / ash
GitHub / ash-project/ash
CVE-2026-67579 2026-08-12
Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
Hex / phoenix_live_view
GitHub / phoenixframework/phoenix_live_view
CVE-2026-64941 2026-08-10
Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset
Hex / ash
GitHub / ash-project/ash
CVE-2026-69659 2026-08-09
Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation
Hex / absinthe_federation
GitHub / divvypayhq/absinthe_federation
CVE-2026-67585 2026-08-07
SQL injection via the :comment option in Postgrex.stream/4
Hex / postgrex
GitHub / elixir-ecto/postgrex
CVE-2026-66838 2026-08-07
Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-68750 2026-08-06
Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-68749 2026-08-06
CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-68747 2026-08-06
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-66829 2026-08-06
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-66370 2026-08-06
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-66843 2026-08-06
Livebook Teams identity callback lacks state binding, allowing login CSRF
Hex / livebook
ghcr.io / livebook-dev/livebook
GitHub / livebook-dev/livebook
CVE-2026-66885 2026-08-05
JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts
Hex / livebook
ghcr.io / livebook-dev/livebook
GitHub / livebook-dev/livebook
CVE-2026-66298 2026-08-05
Unescaped deployment environment variables in generated setup commands
Hex / livebook
ghcr.io / livebook-dev/livebook
GitHub / livebook-dev/livebook
CVE-2026-66297 2026-08-05
Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup
Hex / oidcc_plug
GitHub / erlef/oidcc_plug
CVE-2026-66883 2026-08-04
Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection
Hex / oidcc_plug
GitHub / erlef/oidcc_plug
CVE-2026-66884 2026-08-04
Reflected XSS in oaskit's default HTML error handler
Hex / oaskit
GitHub / lud/oaskit
CVE-2026-66296 2026-08-03
guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55734 2026-08-01
Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55733 2026-08-01
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-54894 2026-08-01
Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55735 2026-08-01
Boruta accepts expired JWT client assertions due to missing exp claim validation
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-54885 2026-07-30
Insufficient verification of Hex package metadata in Gleam
Gleam
GitHub / gleam-lang/gleam
ghcr.io / gleam-lang/gleam
CVE-2026-59247 2026-07-29
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
Hex / cowboy
GitHub / ninenines/cowboy
CVE-2026-65624 2026-07-28
25 per page · 137 CVEs
Page of 6