Hexpm
Hex · 5 CVEs
CVE-2026-23940
HIGH
Denial of Service via Oversized Package Upload
Mar 13, 2026
CVE-2026-21622
CRITICAL
Password Reset Tokens Do Not Expire
Mar 5, 2026
CVE-2026-21621
HIGH
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
Mar 5, 2026
CVE-2026-23939
MEDIUM
Path Traversal in Local File Store Backend
Feb 26, 2026
CVE-2026-21618
HIGH
Cross-site scripting (XSS) in OAuth Device Authorization screen
Jan 19, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-23940 | Denial of Service via Oversized Package Upload | HIGH | 0.44% | Mar 13, 2026 |
| CVE-2026-21622 | Password Reset Tokens Do Not Expire | CRITICAL | 0.40% | Mar 5, 2026 |
| CVE-2026-21621 | Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access | HIGH | 0.34% | Mar 5, 2026 |
| CVE-2026-23939 | Path Traversal in Local File Store Backend | MEDIUM | 0.43% | Feb 26, 2026 |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | HIGH | 0.26% | Jan 19, 2026 |
Showing 1 to 5 of 5 CVEs