Analysis
Common Weaknesses
The most common CWE weakness classes across Erlang ecosystem CVEs
The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.
Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.
Viewing · CWE-1468
Switch view
CWE-1468 at MITRE
Switch view
We're looking at the CWE hierarchy through the Weaknesses Addressed by the OWASP Golang Secure Coding Practices Guide view.
Incorrect Authorization CWE-863
22
(24.7%)
Improper Limitation of a Pathname to a Restricted Directory CWE-22
12
(13.5%)
Improper Neutralization of Input During Web Page Generation CWE-79
11
(12.4%)
Improper Certificate Validation CWE-295
10
(11.2%)
Generation of Error Message Containing Sensitive Information CWE-209
8
(9.0%)
Improper Input Validation CWE-20
5
(5.6%)
Improper Encoding or Escaping of Output CWE-116
5
(5.6%)
Improper Neutralization of Special Elements used in an SQL Command CWE-89
4
(4.5%)
Cleartext Storage of Sensitive Information CWE-312
2
(2.2%)
Cross-Site Request Forgery CWE-352
2
(2.2%)
Insertion of Sensitive Information into Log File CWE-532
2
(2.2%)
Missing Authorization CWE-862
2
(2.2%)
Observable Response Discrepancy CWE-204
1
(1.1%)
Use of Insufficiently Random Values CWE-330
1
(1.1%)
Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497
1
(1.1%)
Inefficient Regular Expression Complexity CWE-1333
1
(1.1%)
Out-of-bounds Read CWE-125
0
(0.0%)
Missing Authentication for Critical Functionality CWE-306
0
(0.0%)
Improper Restriction of Excessive Authentication Attempts CWE-307
0
(0.0%)
Use of Password System for Primary Authentication CWE-309
0
(0.0%)
Missing Encryption of Sensitive Data CWE-311
0
(0.0%)
Cleartext Transmission of Sensitive Information CWE-319
0
(0.0%)
Use of Hard-coded Cryptographic Key CWE-321
0
(0.0%)
Use of Weak Hash CWE-328
0
(0.0%)
Missing Origin Validation in WebSockets CWE-1385
0
(0.0%)
Weak Authentication CWE-1390
0
(0.0%)
Use of Default Password CWE-1393
0
(0.0%)
CVEs
Every CVE in this view
| Summary | Publication | CVE ID | Published |
|---|---|---|---|
| Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1 | CVE-2026-117645 | 2026-10-30 | |
| Host filesystem path disclosure via DNS rebinding | CVE-2026-109823 | 2026-10-27 | |
| Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney | CVE-2026-115693 | 2026-10-26 | |
| AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows | CVE-2026-115627 | 2026-10-25 | |
| AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set | CVE-2026-115635 | 2026-10-25 | |
| Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records | CVE-2026-114214 | 2026-10-25 | |
| WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers | CVE-2026-107685 | 2026-10-23 | |
| Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments | CVE-2026-105963 | 2026-10-23 | |
| TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries |
Erlang
Erlang / ssl
|
CVE-2026-105236 | 2026-10-14 |
| Path traversal in Gleam via unvalidated package application names |
Gleam
ghcr.io / gleam-lang/gleam
|
CVE-2026-103061 | 2026-10-12 |
| Path traversal in rebar3 via unvalidated dependency app names |
rebar3
|
CVE-2026-103060 | 2026-10-12 |
| Path traversal in Hex via unvalidated dependency app names |
Hex Mix Integration
|
CVE-2026-96612 | 2026-10-12 |
| Hex trusts its bundled CA certificates when cacerts_path is set |
Hex Mix Integration
|
CVE-2026-103503 | 2026-10-12 |
| hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 | CVE-2026-103502 | 2026-10-12 | |
| Internal error terms inspected into AshTypescript RPC error responses | CVE-2026-105283 | 2026-10-12 | |
| Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts | CVE-2026-101028 | 2026-10-09 | |
| beam_mcp: nested tool argument constraints advertised but not enforced | CVE-2026-88257 | 2026-10-08 | |
| lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | CVE-2026-92106 | 2026-09-25 | |
| Actor record with password digest stored in AshAuthentication audit log entries | CVE-2026-82723 | 2026-09-17 | |
| ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection | CVE-2026-82756 | 2026-09-07 | |
| inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
Erlang
pkg:otp/inets
|
CVE-2026-74994 | 2026-09-01 |
| Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor | CVE-2026-82747 | 2026-09-01 | |
| Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records | CVE-2026-82749 | 2026-09-01 | |
| Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another | CVE-2026-82748 | 2026-09-01 | |
| Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records | CVE-2026-82746 | 2026-09-01 |
25 per page ·
89 CVEs