Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1337
Switch view
CWE-1337 at MITRE
Switch view
We're looking at the CWE hierarchy through the Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses view.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
9
(17.3%)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79
9
(17.3%)
Deserialization of Untrusted Data CWE-502
5
(9.6%)
Server-Side Request Forgery (SSRF) CWE-918
5
(9.6%)
Improper Input Validation CWE-20
4
(7.7%)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89
4
(7.7%)
Improper Authentication CWE-287
4
(7.7%)
Integer Overflow or Wraparound CWE-190
2
(3.8%)
Exposure of Sensitive Information to an Unauthorized Actor CWE-200
2
(3.8%)
Cross-Site Request Forgery (CSRF) CWE-352
2
(3.8%)
Out-of-bounds Write CWE-787
2
(3.8%)
Missing Authorization CWE-862
2
(3.8%)
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78
1
(1.9%)
Improper Restriction of XML External Entity Reference CWE-611
1
(1.9%)
Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-77
0
(0.0%)
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
0
(0.0%)
Out-of-bounds Read CWE-125
0
(0.0%)
Incorrect Default Permissions CWE-276
0
(0.0%)
Missing Authentication for Critical Function CWE-306
0
(0.0%)
Use After Free CWE-416
0
(0.0%)
Unrestricted Upload of File with Dangerous Type CWE-434
0
(0.0%)
NULL Pointer Dereference CWE-476
0
(0.0%)
Insufficiently Protected Credentials CWE-522
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Use of Hard-coded Credentials CWE-798
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | CVE-2026-88952 | 2026-09-17 | |
| Sign-in token minted for one resource accepted by another in AshAuthentication | CVE-2026-80218 | 2026-09-17 | |
| SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts | CVE-2026-77866 | 2026-09-15 | |
| ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint | CVE-2026-82758 | 2026-09-07 | |
| ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF | CVE-2026-82757 | 2026-09-07 | |
| A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer |
Erlang
pkg:otp/erts
|
CVE-2026-75538 | 2026-09-01 |
| Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records | CVE-2026-82746 | 2026-09-01 | |
| Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs | CVE-2026-82740 | 2026-09-01 | |
| Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service | CVE-2026-82738 | 2026-09-01 | |
| Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads | CVE-2026-82737 | 2026-09-01 | |
| Declared argument constraints not enforced on AshTypescript typed controller routes | CVE-2026-82732 | 2026-09-01 | |
| Path traversal in AshAdmin file uploads via unsanitized client filename | CVE-2026-82673 | 2026-08-31 | |
| Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | CVE-2026-77850 | 2026-08-31 | |
| Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment | CVE-2026-81633 | 2026-08-30 | |
| Cloaked plaintext leaks through a non-sensitive action argument in AshCloak | CVE-2026-81322 | 2026-08-30 | |
| Unsafe deserialization of decrypted terms enables node DoS in AshCloak | CVE-2026-81319 | 2026-08-30 | |
| Doggo vulnerable to cross-site scripting via unescaped date field values | CVE-2026-66353 | 2026-08-27 | |
| Purpose-limited JWT accepted as full bearer authentication in AshAuthentication | CVE-2026-65633 | 2026-08-25 | |
| Reflected XSS in AshAuthentication confirmation and magic link interaction forms | CVE-2026-66882 | 2026-08-25 | |
| Filter expression injection via forged keyset pagination cursor in Ash | CVE-2026-67579 | 2026-08-12 | |
| Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset | CVE-2026-69659 | 2026-08-09 | |
| SQL injection via the :comment option in Postgrex.stream/4 | CVE-2026-66838 | 2026-08-07 | |
| Livebook Teams identity callback lacks state binding, allowing login CSRF |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66885 | 2026-08-05 |
| Unescaped deployment environment variables in generated setup commands |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66297 | 2026-08-05 |
| Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection | CVE-2026-66884 | 2026-08-04 |
25 per page ·
51 CVEs