Analysis

Common Weaknesses

The most common CWE weakness classes across Erlang ecosystem CVEs

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Viewing · CWE-884
Switch view
CWE-884 at MITRE

We're looking at the CWE hierarchy through the CWE Cross-section view.

Allocation of Resources Without Limits or Throttling: 37 CVEs (28.9%) — click to drill down Uncontrolled Resource Consumption: 14 CVEs (10.9%) — click to drill down Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): 8 CVEs (6.3%) — click to drill down Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): 6 CVEs (4.7%) — click to drill down Incorrect Authorization: 6 CVEs (4.7%) — click to drill down Inefficient Algorithmic Complexity: 5 CVEs (3.9%) — click to drill down Improper Handling of Highly Compressed Data (Data Amplification): 5 CVEs (3.9%) — click to drill down URL Redirection to Untrusted Site ('Open Redirect'): 5 CVEs (3.9%) — click to drill down Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): 4 CVEs (3.1%) — click to drill down Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'): 4 CVEs (3.1%) — click to drill down Deserialization of Untrusted Data: 4 CVEs (3.1%) — click to drill down Relative Path Traversal: 3 CVEs (2.3%) — click to drill down Loop with Unreachable Exit Condition ('Infinite Loop'): 3 CVEs (2.3%) — click to drill down Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'): 2 CVEs (1.6%) — click to drill down Authentication Bypass by Spoofing: 2 CVEs (1.6%) — click to drill down Cross-Site Request Forgery (CSRF): 2 CVEs (1.6%) — click to drill down Uncontrolled Recursion: 2 CVEs (1.6%) — click to drill down Improper Link Resolution Before File Access ('Link Following'): 1 CVEs (0.8%) — click to drill down Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): 1 CVEs (0.8%) — click to drill down Improper Control of Generation of Code ('Code Injection'): 1 CVEs (0.8%) — click to drill down Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'): 1 CVEs (0.8%) — click to drill down Integer Underflow (Wrap or Wraparound): 1 CVEs (0.8%) — click to drill down Authentication Bypass by Capture-replay: 1 CVEs (0.8%) — click to drill down Improper Following of a Certificate's Chain of Trust: 1 CVEs (0.8%) — click to drill down Improper Verification of Cryptographic Signature: 1 CVEs (0.8%) — click to drill down Improper Validation of Integrity Check Value: 1 CVEs (0.8%) — click to drill down Time-of-check Time-of-use (TOCTOU) Race Condition: 1 CVEs (0.8%) — click to drill down Download of Code Without Integrity Check: 1 CVEs (0.8%) — click to drill down Operation on a Resource after Expiration or Release: 1 CVEs (0.8%) — click to drill down Reliance on Untrusted Inputs in a Security Decision: 1 CVEs (0.8%) — click to drill down Inclusion of Functionality from Untrusted Control Sphere: 1 CVEs (0.8%) — click to drill down Improper Enforcement of Behavioral Workflow: 1 CVEs (0.8%) — click to drill down Missing Authorization: 1 CVEs (0.8%) — click to drill down Compiler Removal of Code to Clear Buffers: 0 CVEs (0.0%) — click to drill down Absolute Path Traversal: 0 CVEs (0.0%) — click to drill down Improper Resolution of Path Equivalence: 0 CVEs (0.0%) — click to drill down Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'): 0 CVEs (0.0%) — click to drill down Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection'): 0 CVEs (0.0%) — click to drill down Improper Control of Resource Identifiers ('Resource Injection'): 0 CVEs (0.0%) — click to drill down Improper Output Neutralization for Logs: 0 CVEs (0.0%) — click to drill down Improper Validation of Array Index: 0 CVEs (0.0%) — click to drill down Incorrect Calculation of Buffer Size: 0 CVEs (0.0%) — click to drill down Use of Externally-Controlled Format String: 0 CVEs (0.0%) — click to drill down Incorrect Calculation of Multi-Byte String Length: 0 CVEs (0.0%) — click to drill down Improper Null Termination: 0 CVEs (0.0%) — click to drill down Improper Handling of Alternate Encoding: 0 CVEs (0.0%) — click to drill down Double Decoding of the Same Data: 0 CVEs (0.0%) — click to drill down Improper Handling of Mixed Encoding: 0 CVEs (0.0%) — click to drill down Incorrect Behavior Order: Early Validation: 0 CVEs (0.0%) — click to drill down Incorrect Regular Expression: 0 CVEs (0.0%) — click to drill down Integer Overflow or Wraparound: 0 CVEs (0.0%) — click to drill down Off-by-one Error: 0 CVEs (0.0%) — click to drill down Observable Discrepancy: 0 CVEs (0.0%) — click to drill down Generation of Error Message Containing Sensitive Information: 0 CVEs (0.0%) — click to drill down Improper Removal of Sensitive Information Before Storage or Transfer: 0 CVEs (0.0%) — click to drill down Truncation of Security-relevant Information: 0 CVEs (0.0%) — click to drill down Omission of Security-relevant Information: 0 CVEs (0.0%) — click to drill down Improper Handling of Syntactically Invalid Structure: 0 CVEs (0.0%) — click to drill down Improper Clearing of Heap Memory Before Release ('Heap Inspection'): 0 CVEs (0.0%) — click to drill down Uncaught Exception: 0 CVEs (0.0%) — click to drill down Execution with Unnecessary Privileges: 0 CVEs (0.0%) — click to drill down Unchecked Return Value: 0 CVEs (0.0%) — click to drill down Incorrect Check of Function Return Value: 0 CVEs (0.0%) — click to drill down Not Using Password Aging: 0 CVEs (0.0%) — click to drill down Password Aging with Long Expiration: 0 CVEs (0.0%) — click to drill down Incorrect Privilege Assignment: 0 CVEs (0.0%) — click to drill down Privilege Defined With Unsafe Actions: 0 CVEs (0.0%) — click to drill down Privilege Chaining: 0 CVEs (0.0%) — click to drill down Privilege Context Switching Error: 0 CVEs (0.0%) — click to drill down Privilege Dropping / Lowering Errors: 0 CVEs (0.0%) — click to drill down Improper Check for Dropped Privileges: 0 CVEs (0.0%) — click to drill down Unverified Ownership: 0 CVEs (0.0%) — click to drill down Improper Check for Certificate Revocation: 0 CVEs (0.0%) — click to drill down Channel Accessible by Non-Endpoint: 0 CVEs (0.0%) — click to drill down Reflection Attack in an Authentication Protocol: 0 CVEs (0.0%) — click to drill down Missing Critical Step in Authentication: 0 CVEs (0.0%) — click to drill down Missing Authentication for Critical Function: 0 CVEs (0.0%) — click to drill down Improper Restriction of Excessive Authentication Attempts: 0 CVEs (0.0%) — click to drill down Use of Single-factor Authentication: 0 CVEs (0.0%) — click to drill down Cleartext Storage of Sensitive Information: 0 CVEs (0.0%) — click to drill down Cleartext Transmission of Sensitive Information: 0 CVEs (0.0%) — click to drill down Key Exchange without Entity Authentication: 0 CVEs (0.0%) — click to drill down Reusing a Nonce, Key Pair in Encryption: 0 CVEs (0.0%) — click to drill down Missing Cryptographic Step: 0 CVEs (0.0%) — click to drill down Use of a Broken or Risky Cryptographic Algorithm: 0 CVEs (0.0%) — click to drill down Insufficient Entropy: 0 CVEs (0.0%) — click to drill down Small Space of Random Values: 0 CVEs (0.0%) — click to drill down Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG): 0 CVEs (0.0%) — click to drill down Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG): 0 CVEs (0.0%) — click to drill down Predictable from Observable State: 0 CVEs (0.0%) — click to drill down Use of Less Trusted Source: 0 CVEs (0.0%) — click to drill down Acceptance of Extraneous Untrusted Data With Trusted Data: 0 CVEs (0.0%) — click to drill down Missing Support for Integrity Check: 0 CVEs (0.0%) — click to drill down Signal Handler Race Condition: 0 CVEs (0.0%) — click to drill down Divide By Zero: 0 CVEs (0.0%) — click to drill down Detection of Error Condition Without Action: 0 CVEs (0.0%) — click to drill down Missing Report of Error Condition: 0 CVEs (0.0%) — click to drill down Return of Wrong Status Code: 0 CVEs (0.0%) — click to drill down Insufficient Control of Network Message Volume (Network Amplification): 0 CVEs (0.0%) — click to drill down Incorrect Behavior Order: Early Amplification: 0 CVEs (0.0%) — click to drill down Unrestricted Upload of File with Dangerous Type: 0 CVEs (0.0%) — click to drill down User Interface (UI) Misrepresentation of Critical Information: 0 CVEs (0.0%) — click to drill down Insecure Default Variable Initialization: 0 CVEs (0.0%) — click to drill down External Initialization of Trusted Variables or Data Stores: 0 CVEs (0.0%) — click to drill down Non-exit on Failed Initialization: 0 CVEs (0.0%) — click to drill down Missing Initialization of a Variable: 0 CVEs (0.0%) — click to drill down Use of sizeof() on a Pointer Type: 0 CVEs (0.0%) — click to drill down Incorrect Pointer Scaling: 0 CVEs (0.0%) — click to drill down Use of Pointer Subtraction to Determine Size: 0 CVEs (0.0%) — click to drill down Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'): 0 CVEs (0.0%) — click to drill down NULL Pointer Dereference: 0 CVEs (0.0%) — click to drill down Missing Default Case in Multiple Condition Expression: 0 CVEs (0.0%) — click to drill down Use of Incorrect Operator: 0 CVEs (0.0%) — click to drill down Incorrect Block Delimitation: 0 CVEs (0.0%) — click to drill down Omitted Break Statement in Switch: 0 CVEs (0.0%) — click to drill down Comparison of Classes by Name: 0 CVEs (0.0%) — click to drill down Private Data Structure Returned From A Public Method: 0 CVEs (0.0%) — click to drill down Public Data Assigned to Private Array-Typed Field: 0 CVEs (0.0%) — click to drill down Cloneable Class Containing Sensitive Information: 0 CVEs (0.0%) — click to drill down Serializable Class Containing Sensitive Data: 0 CVEs (0.0%) — click to drill down Weak Password Requirements: 0 CVEs (0.0%) — click to drill down Insufficiently Protected Credentials: 0 CVEs (0.0%) — click to drill down Suspicious Comment: 0 CVEs (0.0%) — click to drill down Use of Hard-coded, Security-relevant Constants: 0 CVEs (0.0%) — click to drill down Dead Code: 0 CVEs (0.0%) — click to drill down Assignment to Variable without Use: 0 CVEs (0.0%) — click to drill down Unsynchronized Access to Shared Data in a Multithreaded Context: 0 CVEs (0.0%) — click to drill down Assignment of a Fixed Address to a Pointer: 0 CVEs (0.0%) — click to drill down Comparison of Object References Instead of Object Contents: 0 CVEs (0.0%) — click to drill down Client-Side Enforcement of Server-Side Security: 0 CVEs (0.0%) — click to drill down Multiple Binds to the Same Port: 0 CVEs (0.0%) — click to drill down Reachable Assertion: 0 CVEs (0.0%) — click to drill down Variable Extraction Error: 0 CVEs (0.0%) — click to drill down Dynamic Variable Evaluation: 0 CVEs (0.0%) — click to drill down Function Call with Incorrectly Specified Arguments: 0 CVEs (0.0%) — click to drill down External Control of Critical State Data: 0 CVEs (0.0%) — click to drill down Incorrect Use of Privileged APIs: 0 CVEs (0.0%) — click to drill down Improper Locking: 0 CVEs (0.0%) — click to drill down Use of Potentially Dangerous Function: 0 CVEs (0.0%) — click to drill down Incorrect Conversion between Numeric Types: 0 CVEs (0.0%) — click to drill down Execution After Redirect (EAR): 0 CVEs (0.0%) — click to drill down Incorrect Ownership Assignment: 0 CVEs (0.0%) — click to drill down Incorrect Permission Assignment for Critical Resource: 0 CVEs (0.0%) — click to drill down Missing Custom Error Page: 0 CVEs (0.0%) — click to drill down Release of Invalid Pointer or Reference: 0 CVEs (0.0%) — click to drill down Missing Release of Resource after Effective Lifetime: 0 CVEs (0.0%) — click to drill down Operator Precedence Logic Error: 0 CVEs (0.0%) — click to drill down Access of Memory Location Before Start of Buffer: 0 CVEs (0.0%) — click to drill down Access of Memory Location After End of Buffer: 0 CVEs (0.0%) — click to drill down Use of Hard-coded Credentials: 0 CVEs (0.0%) — click to drill down Buffer Access with Incorrect Length Value: 0 CVEs (0.0%) — click to drill down Untrusted Pointer Dereference: 0 CVEs (0.0%) — click to drill down Expired Pointer Dereference: 0 CVEs (0.0%) — click to drill down Inappropriate Encoding for Output Context: 0 CVEs (0.0%) — click to drill down Numeric Range Comparison Without Minimum Check: 0 CVEs (0.0%) — click to drill down Total 119
Allocation of Resources Without Limits or Throttling CWE-770 37 (28.9%) Uncontrolled Resource Consumption CWE-400 14 (10.9%) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 8 (6.3%) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 6 (4.7%) Incorrect Authorization CWE-863 6 (4.7%) Inefficient Algorithmic Complexity CWE-407 5 (3.9%) Improper Handling of Highly Compressed Data (Data Amplification) CWE-409 5 (3.9%) URL Redirection to Untrusted Site ('Open Redirect') CWE-601 5 (3.9%) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89 4 (3.1%) Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') CWE-444 4 (3.1%) Deserialization of Untrusted Data CWE-502 4 (3.1%) Relative Path Traversal CWE-23 3 (2.3%) Loop with Unreachable Exit Condition ('Infinite Loop') CWE-835 3 (2.3%) Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') CWE-113 2 (1.6%) Authentication Bypass by Spoofing CWE-290 2 (1.6%) Cross-Site Request Forgery (CSRF) CWE-352 2 (1.6%) Uncontrolled Recursion CWE-674 2 (1.6%) Improper Link Resolution Before File Access ('Link Following') CWE-59 1 (0.8%) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 1 (0.8%) Improper Control of Generation of Code ('Code Injection') CWE-94 1 (0.8%) Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-120 1 (0.8%) Integer Underflow (Wrap or Wraparound) CWE-191 1 (0.8%) Authentication Bypass by Capture-replay CWE-294 1 (0.8%) Improper Following of a Certificate's Chain of Trust CWE-296 1 (0.8%) Improper Verification of Cryptographic Signature CWE-347 1 (0.8%) Improper Validation of Integrity Check Value CWE-354 1 (0.8%) Time-of-check Time-of-use (TOCTOU) Race Condition CWE-367 1 (0.8%) Download of Code Without Integrity Check CWE-494 1 (0.8%) Operation on a Resource after Expiration or Release CWE-672 1 (0.8%) Reliance on Untrusted Inputs in a Security Decision CWE-807 1 (0.8%) Inclusion of Functionality from Untrusted Control Sphere CWE-829 1 (0.8%) Improper Enforcement of Behavioral Workflow CWE-841 1 (0.8%) Missing Authorization CWE-862 1 (0.8%) Compiler Removal of Code to Clear Buffers CWE-14 0 (0.0%) Absolute Path Traversal CWE-36 0 (0.0%) Improper Resolution of Path Equivalence CWE-41 0 (0.0%) Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') CWE-88 0 (0.0%) Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CWE-90 0 (0.0%) Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') CWE-95 0 (0.0%) Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') CWE-96 0 (0.0%) Improper Control of Resource Identifiers ('Resource Injection') CWE-99 0 (0.0%) Improper Output Neutralization for Logs CWE-117 0 (0.0%) Improper Validation of Array Index CWE-129 0 (0.0%) Incorrect Calculation of Buffer Size CWE-131 0 (0.0%) Use of Externally-Controlled Format String CWE-134 0 (0.0%) Incorrect Calculation of Multi-Byte String Length CWE-135 0 (0.0%) Improper Null Termination CWE-170 0 (0.0%) Improper Handling of Alternate Encoding CWE-173 0 (0.0%) Double Decoding of the Same Data CWE-174 0 (0.0%) Improper Handling of Mixed Encoding CWE-175 0 (0.0%) Incorrect Behavior Order: Early Validation CWE-179 0 (0.0%) Incorrect Regular Expression CWE-185 0 (0.0%) Integer Overflow or Wraparound CWE-190 0 (0.0%) Off-by-one Error CWE-193 0 (0.0%) Observable Discrepancy CWE-203 0 (0.0%) Generation of Error Message Containing Sensitive Information CWE-209 0 (0.0%) Improper Removal of Sensitive Information Before Storage or Transfer CWE-212 0 (0.0%) Truncation of Security-relevant Information CWE-222 0 (0.0%) Omission of Security-relevant Information CWE-223 0 (0.0%) Improper Handling of Syntactically Invalid Structure CWE-228 0 (0.0%) Improper Clearing of Heap Memory Before Release ('Heap Inspection') CWE-244 0 (0.0%) Uncaught Exception CWE-248 0 (0.0%) Execution with Unnecessary Privileges CWE-250 0 (0.0%) Unchecked Return Value CWE-252 0 (0.0%) Incorrect Check of Function Return Value CWE-253 0 (0.0%) Not Using Password Aging CWE-262 0 (0.0%) Password Aging with Long Expiration CWE-263 0 (0.0%) Incorrect Privilege Assignment CWE-266 0 (0.0%) Privilege Defined With Unsafe Actions CWE-267 0 (0.0%) Privilege Chaining CWE-268 0 (0.0%) Privilege Context Switching Error CWE-270 0 (0.0%) Privilege Dropping / Lowering Errors CWE-271 0 (0.0%) Improper Check for Dropped Privileges CWE-273 0 (0.0%) Unverified Ownership CWE-283 0 (0.0%) Improper Check for Certificate Revocation CWE-299 0 (0.0%) Channel Accessible by Non-Endpoint CWE-300 0 (0.0%) Reflection Attack in an Authentication Protocol CWE-301 0 (0.0%) Missing Critical Step in Authentication CWE-304 0 (0.0%) Missing Authentication for Critical Function CWE-306 0 (0.0%) Improper Restriction of Excessive Authentication Attempts CWE-307 0 (0.0%) Use of Single-factor Authentication CWE-308 0 (0.0%) Cleartext Storage of Sensitive Information CWE-312 0 (0.0%) Cleartext Transmission of Sensitive Information CWE-319 0 (0.0%) Key Exchange without Entity Authentication CWE-322 0 (0.0%) Reusing a Nonce, Key Pair in Encryption CWE-323 0 (0.0%) Missing Cryptographic Step CWE-325 0 (0.0%) Use of a Broken or Risky Cryptographic Algorithm CWE-327 0 (0.0%) Insufficient Entropy CWE-331 0 (0.0%) Small Space of Random Values CWE-334 0 (0.0%) Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) CWE-335 0 (0.0%) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) CWE-338 0 (0.0%) Predictable from Observable State CWE-341 0 (0.0%) Use of Less Trusted Source CWE-348 0 (0.0%) Acceptance of Extraneous Untrusted Data With Trusted Data CWE-349 0 (0.0%) Missing Support for Integrity Check CWE-353 0 (0.0%) Signal Handler Race Condition CWE-364 0 (0.0%) Divide By Zero CWE-369 0 (0.0%) Detection of Error Condition Without Action CWE-390 0 (0.0%) Missing Report of Error Condition CWE-392 0 (0.0%) Return of Wrong Status Code CWE-393 0 (0.0%) Insufficient Control of Network Message Volume (Network Amplification) CWE-406 0 (0.0%) Incorrect Behavior Order: Early Amplification CWE-408 0 (0.0%) Unrestricted Upload of File with Dangerous Type CWE-434 0 (0.0%) User Interface (UI) Misrepresentation of Critical Information CWE-451 0 (0.0%) Insecure Default Variable Initialization CWE-453 0 (0.0%) External Initialization of Trusted Variables or Data Stores CWE-454 0 (0.0%) Non-exit on Failed Initialization CWE-455 0 (0.0%) Missing Initialization of a Variable CWE-456 0 (0.0%) Use of sizeof() on a Pointer Type CWE-467 0 (0.0%) Incorrect Pointer Scaling CWE-468 0 (0.0%) Use of Pointer Subtraction to Determine Size CWE-469 0 (0.0%) Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') CWE-470 0 (0.0%) NULL Pointer Dereference CWE-476 0 (0.0%) Missing Default Case in Multiple Condition Expression CWE-478 0 (0.0%) Use of Incorrect Operator CWE-480 0 (0.0%) Incorrect Block Delimitation CWE-483 0 (0.0%) Omitted Break Statement in Switch CWE-484 0 (0.0%) Comparison of Classes by Name CWE-486 0 (0.0%) Private Data Structure Returned From A Public Method CWE-495 0 (0.0%) Public Data Assigned to Private Array-Typed Field CWE-496 0 (0.0%) Cloneable Class Containing Sensitive Information CWE-498 0 (0.0%) Serializable Class Containing Sensitive Data CWE-499 0 (0.0%) Weak Password Requirements CWE-521 0 (0.0%) Insufficiently Protected Credentials CWE-522 0 (0.0%) Suspicious Comment CWE-546 0 (0.0%) Use of Hard-coded, Security-relevant Constants CWE-547 0 (0.0%) Dead Code CWE-561 0 (0.0%) Assignment to Variable without Use CWE-563 0 (0.0%) Unsynchronized Access to Shared Data in a Multithreaded Context CWE-567 0 (0.0%) Assignment of a Fixed Address to a Pointer CWE-587 0 (0.0%) Comparison of Object References Instead of Object Contents CWE-595 0 (0.0%) Client-Side Enforcement of Server-Side Security CWE-602 0 (0.0%) Multiple Binds to the Same Port CWE-605 0 (0.0%) Reachable Assertion CWE-617 0 (0.0%) Variable Extraction Error CWE-621 0 (0.0%) Dynamic Variable Evaluation CWE-627 0 (0.0%) Function Call with Incorrectly Specified Arguments CWE-628 0 (0.0%) External Control of Critical State Data CWE-642 0 (0.0%) Incorrect Use of Privileged APIs CWE-648 0 (0.0%) Improper Locking CWE-667 0 (0.0%) Use of Potentially Dangerous Function CWE-676 0 (0.0%) Incorrect Conversion between Numeric Types CWE-681 0 (0.0%) Execution After Redirect (EAR) CWE-698 0 (0.0%) Incorrect Ownership Assignment CWE-708 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Missing Custom Error Page CWE-756 0 (0.0%) Release of Invalid Pointer or Reference CWE-763 0 (0.0%) Missing Release of Resource after Effective Lifetime CWE-772 0 (0.0%) Operator Precedence Logic Error CWE-783 0 (0.0%) Access of Memory Location Before Start of Buffer CWE-786 0 (0.0%) Access of Memory Location After End of Buffer CWE-788 0 (0.0%) Use of Hard-coded Credentials CWE-798 0 (0.0%) Buffer Access with Incorrect Length Value CWE-805 0 (0.0%) Untrusted Pointer Dereference CWE-822 0 (0.0%) Expired Pointer Dereference CWE-825 0 (0.0%) Inappropriate Encoding for Output Context CWE-838 0 (0.0%) Numeric Range Comparison Without Minimum Check CWE-839 0 (0.0%)

CVEs

Every CVE in this view

Summary Publication CVE ID Published
Filter expression injection via forged keyset pagination cursor in Ash
Hex / ash
GitHub / ash-project/ash
CVE-2026-67579 2026-08-12
Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
Hex / phoenix_live_view
GitHub / phoenixframework/phoenix_live_view
CVE-2026-64941 2026-08-10
Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset
Hex / ash
GitHub / ash-project/ash
CVE-2026-69659 2026-08-09
Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation
Hex / absinthe_federation
GitHub / divvypayhq/absinthe_federation
CVE-2026-67585 2026-08-07
SQL injection via the :comment option in Postgrex.stream/4
Hex / postgrex
GitHub / elixir-ecto/postgrex
CVE-2026-66838 2026-08-07
Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-68750 2026-08-06
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-66829 2026-08-06
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-66370 2026-08-06
html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding
Hex / html_sanitize_ex
GitHub / rrrene/html_sanitize_ex
CVE-2026-66843 2026-08-06
Livebook Teams identity callback lacks state binding, allowing login CSRF
Hex / livebook
ghcr.io / livebook-dev/livebook
GitHub / livebook-dev/livebook
CVE-2026-66885 2026-08-05
Unescaped deployment environment variables in generated setup commands
Hex / livebook
ghcr.io / livebook-dev/livebook
GitHub / livebook-dev/livebook
CVE-2026-66297 2026-08-05
Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download
Hex / livebook
ghcr.io / livebook-dev/livebook
GitHub / livebook-dev/livebook
CVE-2026-66881 2026-08-05
Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection
Hex / oidcc_plug
GitHub / erlef/oidcc_plug
CVE-2026-66884 2026-08-04
Reflected XSS in oaskit's default HTML error handler
Hex / oaskit
GitHub / lud/oaskit
CVE-2026-66296 2026-08-03
guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55734 2026-08-01
Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55733 2026-08-01
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-54894 2026-08-01
Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Hex / guardian
GitHub / ueberauth/guardian
CVE-2026-55735 2026-08-01
Boruta accepts expired JWT client assertions due to missing exp claim validation
Hex / boruta
GitHub / malach-it/boruta_auth
CVE-2026-53431 2026-07-30
Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion
Hex / cowboy
GitHub / ninenines/cowboy
CVE-2026-65624 2026-07-28
Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS
Hex / cowlib
GitHub / ninenines/cowlib
CVE-2026-59248 2026-07-28
BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding
Erlang / erts
GitHub / erlang/otp
CVE-2026-54890 2026-07-27
Denial of service via exponential certificate policy tree growth in path validation
Erlang / public_key
GitHub / erlang/otp
CVE-2026-59251 2026-07-27
Megaco flex scanner buffer overflow via oversized property parm name
Erlang / megaco
GitHub / erlang/otp
CVE-2026-59250 2026-07-27
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Erlang / stdlib
GitHub / erlang/otp
CVE-2026-47078 2026-07-27
25 per page · 119 CVEs
Page of 5