Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1340
Switch view
CWE-1340 at MITRE
Switch view
We're looking at the CWE hierarchy through the CISQ Data Protection Measures view.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
11
(26.2%)
Improper Access Control CWE-284
10
(23.8%)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79
6
(14.3%)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89
4
(9.5%)
Deserialization of Untrusted Data CWE-502
4
(9.5%)
Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119
2
(4.8%)
Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-77
1
(2.4%)
Improper Restriction of XML External Entity Reference CWE-611
1
(2.4%)
Operation on a Resource after Expiration or Release CWE-672
1
(2.4%)
Incorrect Conversion between Numeric Types CWE-681
1
(2.4%)
Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915
1
(2.4%)
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CWE-90
0
(0.0%)
XML Injection (aka Blind XPath Injection) CWE-91
0
(0.0%)
Improper Control of Resource Identifiers ('Resource Injection') CWE-99
0
(0.0%)
Improper Validation of Array Index CWE-129
0
(0.0%)
Use of Externally-Controlled Format String CWE-134
0
(0.0%)
Improper Null Termination CWE-170
0
(0.0%)
Exposure of Sensitive Information Due to Incompatible Policies CWE-213
0
(0.0%)
Missing Encryption of Sensitive Data CWE-311
0
(0.0%)
Exposure of Private Personal Information to an Unauthorized Actor CWE-359
0
(0.0%)
Improper Resource Shutdown or Release CWE-404
0
(0.0%)
Improper Protection of Alternate Path CWE-424
0
(0.0%)
Unrestricted Upload of File with Dangerous Type CWE-434
0
(0.0%)
Return of Stack Variable Address CWE-562
0
(0.0%)
Unchecked Input for Loop Condition CWE-606
0
(0.0%)
Improper Neutralization of Data within XPath Expressions ('XPath Injection') CWE-643
0
(0.0%)
Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') CWE-652
0
(0.0%)
Improper Synchronization CWE-662
0
(0.0%)
Improper Initialization CWE-665
0
(0.0%)
Incorrect Calculation CWE-682
0
(0.0%)
Improper Check or Handling of Exceptional Conditions CWE-703
0
(0.0%)
Incorrect Type Conversion or Cast CWE-704
0
(0.0%)
Incorrect Permission Assignment for Critical Resource CWE-732
0
(0.0%)
Use of Hard-coded Credentials CWE-798
0
(0.0%)
Use of Uninitialized Resource CWE-908
0
(0.0%)
Initialization with Hard-Coded Network Resource Configuration Data CWE-1051
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Filter expression injection via forged keyset pagination cursor in Ash | CVE-2026-67579 | 2026-08-12 | |
| Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset | CVE-2026-69659 | 2026-08-09 | |
| SQL injection via the :comment option in Postgrex.stream/4 | CVE-2026-66838 | 2026-08-07 | |
| Unescaped deployment environment variables in generated setup commands |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66297 | 2026-08-05 |
| Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download |
ghcr.io / livebook-dev/livebook
|
CVE-2026-66881 | 2026-08-05 |
| Reflected XSS in oaskit's default HTML error handler | CVE-2026-66296 | 2026-08-03 | |
| Megaco flex scanner buffer overflow via oversized property parm name |
Erlang / megaco
|
CVE-2026-59250 | 2026-07-27 |
| Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder |
Erlang / erts
|
CVE-2026-55737 | 2026-07-27 |
| Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass |
Erlang / stdlib
|
CVE-2026-47078 | 2026-07-27 |
| Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link> | CVE-2026-58228 | 2026-07-13 | |
| SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service | CVE-2026-58225 | 2026-07-10 | |
| Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS) | CVE-2026-54889 | 2026-06-29 | |
| Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute | CVE-2026-53427 | 2026-06-29 | |
| Private action arguments can be set by user input in Ash | CVE-2026-55736 | 2026-06-23 | |
| Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc | CVE-2026-48853 | 2026-06-15 | |
| Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding | CVE-2026-48599 | 2026-06-15 | |
| Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist |
Erlang / ssl
|
CVE-2026-48860 | 2026-06-10 |
| Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-32685 | 2026-06-02 |
| Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-43965 | 2026-06-02 |
| OCSP responder certificate validity period not checked in public_key |
Erlang / public_key
|
CVE-2026-42791 | 2026-05-27 |
| Missing authorization check on save-job event handler in oban_web | CVE-2026-48592 | 2026-05-26 | |
| Cross-session PubSub topic injection via URL parameter in phoenix_storybook | CVE-2026-47068 | 2026-05-20 | |
| SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3 | CVE-2026-32687 | 2026-05-12 | |
| Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug | CVE-2026-42794 | 2026-05-08 | |
| SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT |
Erlang / ssh
|
CVE-2026-32147 | 2026-04-21 |
25 per page ·
40 CVEs