Issued CVEs

CVE ID	Title	Packages	Severity	Published
CVE-2026-64941	Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR	Hex / phoenix_live_view GitHub / phoenixframework/phoenix_live_view	L 2.1	2026-08-10
CVE-2026-70395	Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash	Hex / ash GitHub / ash-project/ash	L 2.1	2026-08-09
CVE-2026-69659	Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset	Hex / ash GitHub / ash-project/ash	M 5.9	2026-08-09
CVE-2026-67585	Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation	Hex / absinthe_federation GitHub / divvypayhq/absinthe_federation	H 8.7	2026-08-07
CVE-2026-66838	SQL injection via the :comment option in Postgrex.stream/4	Hex / postgrex GitHub / elixir-ecto/postgrex	M 5.9	2026-08-07
CVE-2026-68750	Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service	Hex / html_sanitize_ex GitHub / rrrene/html_sanitize_ex	H 8.2	2026-08-06
CVE-2026-68749	Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service	Hex / html_sanitize_ex GitHub / rrrene/html_sanitize_ex	H 8.2	2026-08-06
CVE-2026-68747	CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input	Hex / html_sanitize_ex GitHub / rrrene/html_sanitize_ex	L 2.3	2026-08-06
CVE-2026-66829	html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection	Hex / html_sanitize_ex GitHub / rrrene/html_sanitize_ex	L 2.3	2026-08-06
CVE-2026-66370	html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking	Hex / html_sanitize_ex GitHub / rrrene/html_sanitize_ex	M 4.8	2026-08-06
CVE-2026-66843	html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding	Hex / html_sanitize_ex GitHub / rrrene/html_sanitize_ex	L 2.3	2026-08-06
CVE-2026-66885	Livebook Teams identity callback lacks state binding, allowing login CSRF	Hex / livebook ghcr.io / livebook-dev/livebook GitHub / livebook-dev/livebook	M 6.8	2026-08-05
CVE-2026-66298	JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts	Hex / livebook ghcr.io / livebook-dev/livebook GitHub / livebook-dev/livebook	H 8.6	2026-08-05
CVE-2026-66297	Unescaped deployment environment variables in generated setup commands	Hex / livebook ghcr.io / livebook-dev/livebook GitHub / livebook-dev/livebook	M 5.0	2026-08-05
CVE-2026-66881	Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download	Hex / livebook ghcr.io / livebook-dev/livebook GitHub / livebook-dev/livebook	H 7.0	2026-08-05
CVE-2026-68746	Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access	Hex / livebook ghcr.io / livebook-dev/livebook GitHub / livebook-dev/livebook	H 7.7	2026-08-05
CVE-2026-66883	Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup	Hex / oidcc_plug GitHub / erlef/oidcc_plug	M 6.3	2026-08-04
CVE-2026-66884	Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection	Hex / oidcc_plug GitHub / erlef/oidcc_plug	L 2.1	2026-08-04
CVE-2026-66296	Reflected XSS in oaskit's default HTML error handler	Hex / oaskit GitHub / lud/oaskit	M 5.1	2026-08-03
CVE-2026-55734	guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1	Hex / guardian GitHub / ueberauth/guardian	M 6.9	2026-08-01
CVE-2026-55733	Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation	Hex / guardian GitHub / ueberauth/guardian	M 6.9	2026-08-01
CVE-2026-54894	Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys	Hex / guardian GitHub / ueberauth/guardian	M 6.9	2026-08-01
CVE-2026-55735	Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation	Hex / guardian GitHub / ueberauth/guardian	H 8.2	2026-08-01
CVE-2026-65636	YAML injection via unescaped newlines in ymlr document comments	Hex / ymlr GitHub / ufirstgroup/ymlr	L 2.1	2026-07-31
CVE-2026-53431	Boruta accepts expired JWT client assertions due to missing exp claim validation	Hex / boruta GitHub / malach-it/boruta_auth	C 9.1	2026-07-30

CVE-2026-64941

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

Hex / phoenix_live_view

GitHub / phoenixframework/phoenix_live_view

L 2.1

2026-08-10

CVE-2026-70395

Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash

Hex / ash

GitHub / ash-project/ash

L 2.1

2026-08-09