Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1340
Switch view
CWE-1340 at MITRE
Switch view
We're looking at the CWE hierarchy through the CISQ Data Protection Measures view.
Improper Access Control CWE-284
37
(42.0%)
Improper Limitation of a Pathname to a Restricted Directory CWE-22
15
(17.0%)
Improper Neutralization of Input During Web Page Generation CWE-79
11
(12.5%)
Deserialization of Untrusted Data CWE-502
5
(5.7%)
Improper Neutralization of Special Elements used in an SQL Command CWE-89
4
(4.5%)
Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915
3
(3.4%)
XML Injection CWE-91
2
(2.3%)
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
2
(2.3%)
Improper Resource Shutdown or Release CWE-404
2
(2.3%)
Improper Protection of Alternate Path CWE-424
2
(2.3%)
Improper Neutralization of Special Elements used in a Command CWE-77
1
(1.1%)
Improper Restriction of XML External Entity Reference CWE-611
1
(1.1%)
Operation on a Resource after Expiration or Release CWE-672
1
(1.1%)
Incorrect Conversion between Numeric Types CWE-681
1
(1.1%)
Incorrect Type Conversion or Cast CWE-704
1
(1.1%)
Improper Neutralization of Special Elements used in an LDAP Query CWE-90
0
(0.0%)
Improper Control of Resource Identifiers CWE-99
0
(0.0%)
Improper Validation of Array Index CWE-129
0
(0.0%)
Use of Externally-Controlled Format String CWE-134
0
(0.0%)
Improper Null Termination CWE-170
0
(0.0%)
Exposure of Sensitive Information Due to Incompatible Policies CWE-213
0
(0.0%)
Missing Encryption of Sensitive Data CWE-311
0
(0.0%)
Exposure of Private Personal Information to an Unauthorized Actor CWE-359
0
(0.0%)
Unrestricted Upload of File with Dangerous Type CWE-434
0
(0.0%)
Return of Stack Variable Address CWE-562
0
(0.0%)
Unchecked Input for Loop Condition CWE-606
0
(0.0%)
Improper Neutralization of Data within XPath Expressions CWE-643
0
(0.0%)
Improper Neutralization of Data within XQuery Expressions CWE-652
0
(0.0%)
Improper Synchronization CWE-662
0
(0.0%)
Improper Initialization CWE-665
0
(0.0%)
Incorrect Calculation CWE-682
0
(0.0%)
Improper Check or Handling of Exceptional Conditions CWE-703
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Use of Hard-coded Credentials CWE-798
0
(0.0%)
Use of Uninitialized Resource CWE-908
0
(0.0%)
Initialization with Hard-Coded Network Resource Configuration Data CWE-1051
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records | CVE-2026-96581 | 2026-10-26 | |
| AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | CVE-2026-115627 | 2026-10-25 | |
| AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | CVE-2026-115635 | 2026-10-25 | |
| Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records | CVE-2026-114214 | 2026-10-25 | |
| Path traversal in Gleam via unvalidated package application names |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-103061 | 2026-10-12 |
| Path traversal in rebar3 via unvalidated dependency app names |
rebar3
|
CVE-2026-103060 | 2026-10-12 |
| Path traversal in Hex via unvalidated dependency app names |
Hex Mix Integration
|
CVE-2026-96612 | 2026-10-12 |
| Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts | CVE-2026-101028 | 2026-10-09 | |
| beam_mcp: JSON boolean and null tool arguments reach dispatch as strings | CVE-2026-104634 | 2026-10-08 | |
| lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | CVE-2026-92106 | 2026-09-25 | |
| Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash | CVE-2026-93477 | 2026-09-25 | |
| OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication | CVE-2026-88952 | 2026-09-17 | |
| Sign-in token minted for one resource accepted by another in AshAuthentication | CVE-2026-80218 | 2026-09-17 | |
| Confirmation token accepted on any record in AshAuthentication | CVE-2026-82685 | 2026-09-17 | |
| AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes | CVE-2026-82586 | 2026-09-07 | |
| ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint | CVE-2026-82758 | 2026-09-07 | |
| ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls | CVE-2026-82754 | 2026-09-07 | |
| httpd parks a request worker indefinitely on a malformed chunk size sent after the headers |
Erlang
pkg:otp/inets
|
CVE-2026-69664 | 2026-09-01 |
| inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
Erlang
pkg:otp/inets
|
CVE-2026-74994 | 2026-09-01 |
| httpd applies no timeout while receiving a request body, parking a worker on a stalled client |
Erlang
pkg:otp/inets
|
CVE-2026-71380 | 2026-09-01 |
| Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor | CVE-2026-82747 | 2026-09-01 | |
| Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records | CVE-2026-82749 | 2026-09-01 | |
| Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another | CVE-2026-82748 | 2026-09-01 | |
| Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records | CVE-2026-82746 | 2026-09-01 |
25 per page ·
86 CVEs