Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1003
Switch view
CWE-1003 at MITRE
Switch view
We're looking at the CWE hierarchy through the Weaknesses for Simplified Mapping of Published Vulnerabilities view.
Uncontrolled Resource Consumption CWE-400
61
(24.0%)
Incorrect Authorization CWE-863
24
(9.4%)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-74
19
(7.5%)
Improper Input Validation CWE-20
17
(6.7%)
Improper Authentication CWE-287
17
(6.7%)
Use of Incorrectly-Resolved Name or Reference CWE-706
14
(5.5%)
Externally Controlled Reference to a Resource in Another Sphere CWE-610
13
(5.1%)
Insufficient Verification of Data Authenticity CWE-345
12
(4.7%)
Exposure of Sensitive Information to an Unauthorized Actor CWE-200
10
(3.9%)
Inefficient Algorithmic Complexity CWE-407
9
(3.5%)
Interpretation Conflict CWE-436
8
(3.1%)
Improper Encoding or Escaping of Output CWE-116
6
(2.4%)
Operation on a Resource after Expiration or Release CWE-672
6
(2.4%)
Improper Control of Dynamically-Managed Code Resources CWE-913
5
(2.0%)
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-362
4
(1.6%)
Uncontrolled Recursion CWE-674
4
(1.6%)
Excessive Iteration CWE-834
4
(1.6%)
Improper Resource Shutdown or Release CWE-404
3
(1.2%)
Incorrect Resource Transfer Between Spheres CWE-669
3
(1.2%)
Incorrect Calculation CWE-682
3
(1.2%)
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
2
(0.8%)
Missing Encryption of Sensitive Data CWE-311
2
(0.8%)
Improper Check for Unusual or Exceptional Conditions CWE-754
2
(0.8%)
Missing Authorization CWE-862
2
(0.8%)
Use of Insufficiently Random Values CWE-330
1
(0.4%)
Exposure of Resource to Wrong Sphere CWE-668
1
(0.4%)
Incorrect Comparison CWE-697
1
(0.4%)
Improper Handling of Exceptional Conditions CWE-755
1
(0.4%)
Improper Privilege Management CWE-269
0
(0.0%)
Inadequate Encryption Strength CWE-326
0
(0.0%)
Use of a Broken or Risky Cryptographic Algorithm CWE-327
0
(0.0%)
Improper Synchronization CWE-662
0
(0.0%)
Improper Initialization CWE-665
0
(0.0%)
Always-Incorrect Control Flow Implementation CWE-670
0
(0.0%)
Incorrect Type Conversion or Cast CWE-704
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Insecure Storage of Sensitive Information CWE-922
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Session id is not renewed on authentication in ash_authentication, allowing session fixation | CVE-2026-86688 | 2026-09-17 | |
| Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement | CVE-2026-76949 | 2026-09-17 | |
| dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover | CVE-2026-91039 | 2026-09-17 | |
| OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | CVE-2026-88952 | 2026-09-17 | |
| Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix | CVE-2026-86533 | 2026-09-17 | |
| Sign-in token minted for one resource accepted by another in AshAuthentication | CVE-2026-80218 | 2026-09-17 | |
| Token revocation record built from unverified JWT claims in AshAuthentication | CVE-2026-78223 | 2026-09-17 | |
| Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication | CVE-2026-81637 | 2026-09-17 | |
| Magic link single-use tokens replayable via TOCTOU race in AshAuthentication | CVE-2026-82761 | 2026-09-17 | |
| Confirmation token accepted on any record in AshAuthentication | CVE-2026-82685 | 2026-09-17 | |
| Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in | CVE-2026-82760 | 2026-09-17 | |
| Actor record with password digest stored in AshAuthentication audit log entries | CVE-2026-82723 | 2026-09-17 | |
| SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts | CVE-2026-77866 | 2026-09-15 | |
| safeurl validated address is not bound to the request, allowing DNS rebinding | CVE-2026-77972 | 2026-09-15 | |
| ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint | CVE-2026-82758 | 2026-09-07 | |
| ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF | CVE-2026-82757 | 2026-09-07 | |
| ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection | CVE-2026-82756 | 2026-09-07 | |
| Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server | CVE-2026-82753 | 2026-09-07 | |
| Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation | CVE-2026-82750 | 2026-09-06 | |
| Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning | CVE-2026-82751 | 2026-09-06 | |
| Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length | CVE-2026-82752 | 2026-09-05 | |
| Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS | CVE-2026-82728 | 2026-09-04 | |
| Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS | CVE-2026-82729 | 2026-09-04 | |
| httpd parks a request worker indefinitely on a malformed chunk size sent after the headers |
Erlang
pkg:otp/inets
|
CVE-2026-69664 | 2026-09-01 |
| eldap does not bound the port component of a referral URL before integer conversion |
Erlang
pkg:otp/eldap
|
CVE-2026-70409 | 2026-09-01 |
25 per page ·
245 CVEs