CVE Browser

TodayOct 8th 42 Last 7 days 2,791 CISA KEV 1,734 Critical 42,691 All stats

Page 1

Vendor: Phoenixframework Clear all

CVE-2026-64941 LOW

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

CVSS 2.1 EPSS 0.60% Aug 10, 2026

CVE-2026-58228 MEDIUM

Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

CVSS 5.1 EPSS 0.57% Jul 13, 2026

CVE-2026-56812 MEDIUM

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

CVSS 6.3 EPSS 0.80% Jul 7, 2026

Hexnpm

CVE-2026-56811 HIGH

Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service

CVSS 8.7 EPSS 0.78% Jul 7, 2026

CVE-2026-32689 HIGH

Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix

CVSS 8.7 EPSS 0.52% May 5, 2026

CVE-2021-46871 MEDIUM

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.

CVSS 6.1 EPSS 0.41% Jan 10, 2023

Hexnpm

CVE-2022-42975 HIGH

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence…

CVSS 7.5 EPSS 0.57% Oct 17, 2022

CVE-2017-1000163 MEDIUM

The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may r…

CVSS 6.1 EPSS 2.38% Nov 17, 2017

CVE ID	Description	Severity	CVSS	EPSS	Ecosystems	Published
CVE-2026-64941	Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR	LOW	2.1	0.60%		Aug 10, 2026
CVE-2026-58228	Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>	MEDIUM	5.1	0.57%		Jul 13, 2026
CVE-2026-56812	Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff	MEDIUM	6.3	0.80%	Hexnpm	Jul 7, 2026
CVE-2026-56811	Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service	HIGH	8.7	0.78%		Jul 7, 2026
CVE-2026-32689	Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix	HIGH	8.7	0.52%		May 5, 2026
CVE-2021-46871	tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.	MEDIUM	6.1	0.41%	Hexnpm	Jan 10, 2023
CVE-2022-42975	socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence…	HIGH	7.5	0.57%		Oct 17, 2022
CVE-2017-1000163	The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may r…	MEDIUM	6.1	2.38%		Nov 17, 2017

Rows per page

Showing 1 to 8 CVEs · page 1